Hacking Articles Tips Tricks Videos Tutorials

YELLOWFIN < 9.6.1 MULTIPLE VULNERABILITIES
----------------------------------------------------

Vulnerability:
==============
Stored Cross-Site Scripting

Affected Products and Versions:
===============================
Yellowfin < 9.6.1

CVEID:
======
CVE-2021-36387

CVSSv3.1 Score:
===============
5.4 (Medium)

CVSSv3.1 Attack Vector:
=======================
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Short Description:
==================
In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4".

Remediation:
============
Update Yellowfin to the latest version available

Discoverer:
===========
Michele Di Bonaventura (cyberaz0r)

Reference:
==========
https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6

----------------------------------------------------

Vulnerability:
==============
Insecure Direct Object Reference

Affected Products and Versions:
===============================
Yellowfin < 9.6.1

CVEID:
======
CVE-2021-36388

CVSSv3.1 Score:
===============
7.5 (High)

CVSSv3.1 Attack Vector:
=======================
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Short Description:
==================
In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".

Remediation:
============
Update Yellowfin to the latest version available

Discoverer:
===========
Michele Di Bonaventura (cyberaz0r)

Reference:
==========
https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6

----------------------------------------------------

Vulnerability:
==============
Insecure Direct Object Reference

Affected Products and Versions:
===============================
Yellowfin < 9.6.1

CVEID:
======
CVE-2021-36389

CVSSv3.1 Score:
===============
7.5 (High)

CVSSv3.1 Attack Vector:
=======================
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Short Description:
==================
In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4".

Remediation:
============
Update Yellowfin to the latest version available

Discoverer:
===========
Michele Di Bonaventura (cyberaz0r)

Reference:
==========
https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6

----------------------------------------------------

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Yellowfin Cross Site Scripting / Insecure Direct Object Reference

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 16:30

Hacking Articles Tips Tricks Videos Tutorials

4 views16:30

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
TextPattern CMS 4.8.7 Shell Upload

https://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png
TextPattern CMS version 4.8.7 suffers from an authenticated remote shell upload vulnerability.

MD5 | a48c73645293b99b6fbcfeb552bf7cc4

Download
# Exploit Title: TextPattern CMS 4.8.7 - Remote Command Execution (RCE) (Authenticated)
# Date: 2021/09/06
# Exploit Author: Mert Daş merterpreter@gmail.com
# Software Link: https://textpattern.com/file_download/113/textpattern-4.8.7.zip
# Software web: https://textpattern.com/
# Tested on: Server: Xampp

First of all we should use file upload section to upload our shell.
Our shell contains this malicious code:
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

TextPattern CMS 4.8.7 Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 16:30

Hacking Articles Tips Tricks Videos Tutorials

4 views16:30

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
SolarWinds Kiwi CatTools 3.11.8 Unquoted Service Path

https://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png
SolarWinds Kiwi CatTools version 3.11.8 suffers from an unquoted service path vulnerability.

MD5 | acc6ac66fedd5db07765a9c5c1fc9e3c

Download

# Exploit Title: SolarWinds Kiwi CatTools 3.11.8 - Unquoted Service Path
# Exploit Author: Mert DAŞ
# Version: 3.11.8
# Date: 14.10.2021
# Vendor Homepage: https://www.solarwinds.com/
# Tested on: Windows 10

# Step to discover Unquoted Service Path :

--------------------------------------
C:\Users\Mert>sc qc CatTools
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: CatTools
TYPE               : 10  WIN32_OWN_PROCESS
START_TYPE         : 2   AUTO_START
ERROR_CONTROL      : 1   NORMAL
BINARY_PATH_NAME   : C:\Program Files (x86)\CatTools3\nssm.exe
LOAD_ORDER_GROUP   :
TAG                : 0
DISPLAY_NAME       : CatTools
DEPENDENCIES       :
SERVICE_START_NAME : LocalSystem
---------------------------------------------

Or:
-------------------------
C:\Users\Mert>wmic service get name,displayname,pathname,startmode |findstr
/i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
----------------------

#Exploit:

A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other security
applications where it could potentially be executed during application
startup or reboot. If successful, the local user's code would execute with
the elevated privileges of the application.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

SolarWinds Kiwi CatTools 3.11.8 Unquoted Service Path

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 16:30

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
IFSC Code Finder Project 1.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

IFSC Code Finder Project 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

12 viewsedited 16:30

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
How Security Teams Can Reinforce End-User Awareness

Training programs provide the information, but security teams can reinforce these for better end-user education.

12 views17:44

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
The Human Element Is the Weakest Link

While the recent Facebook outage was a major inconvenience, the impact of leaked business operations documents is a much bigger issue than being down for a few hours.

10 views17:45

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Open Source Security Foundation Raises $10M

Industry leaders from technology, financial services, telecom, and cybersecurity sectors respond to Biden's executive order and commit to a more secure future for software.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Open Source Security Foundation Raises $10M

Industry leaders from technology, financial services, telecom, and cybersecurity sectors respond to Biden's executive order and commit to a more secure future for software.

7 viewsedited 17:45

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Entering a Windows 7 without a password

Apologies if this is the wrong sub...

Basically, in not my brightest moment, I decided to change the password of my PC for a more secure password than now I don't remember...

So I'm not sure how can I access without the password now, pc main harddrive is full of important information and I wonder how could I bypass the password to at least retrieve the data...

For more info, the windows version is not the official so I couldn't reset it via Microsoft,

Is there anything I could possibly do?

submitted by /u/ZaZenleaf
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

From the hacking community on Reddit

Explore this post and more from the hacking community

5 viewsedited 19:04

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Reset Company/Corporate laptop to Normal personal laptop...

Hello everyone, I hope you are doing fine. I've been wondering how to convert a company laptop to a normal personal laptop. Like, removing all the restrictions to install certain apps etc....thanks..

submitted by /u/Any-Boysenberry-9918
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Reset Company/Corporate laptop to Normal personal laptop...

Hello everyone, I hope you are doing fine. I've been wondering how to convert a company laptop to a normal personal laptop. Like, removing all the...

5 viewsedited 19:04

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Train SSIDS are EXTREMELY vulnerable aren't they?

So I'm sitting in the train using the free wifi provided (like in hotels) and I'm thinking that theoretically I could start a fake router with the exact same SSID and the same HUD and actually give the people connecting internet so they log in to everything and I just sniff them to oblivion.

Is there a logic flaw I'm not seeing? God fucking damnit should've connected to a VPN before logging on to Paypal fml.

Really that easy to screw people nowadays?

Thanks.

Edit: Title should be sth like "Public WiFi is dangerous isn't it?"

submitted by /u/KommissarKong
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Train SSIDS are EXTREMELY vulnerable aren't they?

So I'm sitting in the train using the free wifi provided (like in hotels) and I'm thinking that theoretically I could start a fake router with the...

5 viewsedited 19:04

Hacking Articles Tips Tricks Videos Tutorials

6 views19:46

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Hackthebox Monitors writeup | Monitor Hack the box walkthrough

https://cdn-images-1.medium.com/max/1185/0*W4C4eY5q3xnRfSOm.png
If you find this write-up helpful consider following me and a clap would really motivate me to write more such blogs.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Hackthebox Monitors writeup | Monitor Hack the box walkthrough

If you find this write-up helpful consider following me and a clap would really motivate me to write more such blogs.

5 viewsedited 19:46