Hi , My name is Ahmed Magdy  :)Continue reading on Medium » (https://ahmed8magdy.medium.com/file-upload-to-rce-538bb4128062?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/Snakez666
[link] [comments]

File Upload to RCE

Hi , My name is Ahmed Magdy :)Continue reading on Medium »
Read more...

Exploit Collector
Reprise License Manager 14.2 Buffer Overflow

https://4.bp.blogspot.com/-4tZE0Y76jWM/WWlvMNv2FRI/AAAAAAAAIMQ/Di9LOyWyOssTbh7urhFnaBV0oE1qNf8CgCLcBGAs/s1600/h19.png
Reprise License Manager version 14.2 suffers from an authenticated buffer overflow vulnerability.

MD5 | d1b7870de7c214de0386404223b52728

Download

# Product: Reprise License Manager 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2021-44154
# Vulnerability Title: Authenticated Buffer Overflow
# Severity: High
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard
# Date: 2021-11-25
#############################################################
Introduction:
By using an authenticated account, an attacker can write a payload to /goform/edit_opt, which will then be triggered when running the diagnostics (via /goform/diagnostics_doit), resulting in a buffer overflow.

Vulnerability:
When writing to options within RLM, if an input is longer than 1024 chars it will result in a buffer overflow, allowing either a secfault, crashing the program, or potentially resulting in RCE.

Recommendation:
Validate input lengths before copying into a buffer.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Reprise License Manager 14.2 User Enumeration

https://2.bp.blogspot.com/-4wIBcK0z7y4/WWlvHXARtRI/AAAAAAAAILc/wzdKaT4lYrUxiztYZaNra08YExR9F67-wCLcBGAs/s1600/h14.png
Reprise License Manager version 14.2 suffers from a user enumeration vulnerability.

MD5 | 193bb8c1503c298f61459df2f124a49e

Download
# Product: Reprise License Manager 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2021-44155
# Vulnerability Title: Unauthenticated User Enumeration
# Severity: Low
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard
# Date: 2021-11-25
#############################################################
Introduction:
An issue was discovered in /goform/login_process in RLM 14.2. When an attacker attempts to login, the response if an username is valid includes "Login Failed", but does not include this string if the username is invalid. This allows an attacker to enumerate valid users.

Vulnerability:
This vulnerability is triggered upon failed authentication, if an attacker supplies an invalid user with an invalid password no error message is given however if an attacker supplies the application with a valid user with an invalid password an error message is displayed informing the user "Login Failed". The difference in response can be abused in order to allow an attacker to enumerate valid users.

Recommendation:
We recommend displaying generic error messages upon failed authentication to mitigate the possibility of an attacker enumerating valid users.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ETS5 Password Recovery Tool

https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
ETS Password Recovery Tool allows you to recover passwords for an ETS5 project. This is due to a significant design flaw as ETS5 uses a hard-coded password and salt to encrypt the project information.

MD5 | 90915ab46d587526fdc2a5369557661e

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Reprise License Manager 14.2 Remote Binary Execution

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png
Reprise License Manager version 14.2 suffers from an authenticated remote binary execution vulnerability.

MD5 | 168a71810d65bf8de3fe62438600faa2

Download
# Product: Reprise License Manager 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2021-44153
# Vulnerability Title: Authenticated Remote Binary Execution
# Severity: High
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard
# Date: 2021-11-25
#############################################################

Introduction:

When editing the license file, it is possible for an admin user to enable an option to run arbitrary executables.
An attacker can exploit this to run a malicious binary on startup, or when triggering the "Reread/Restart Servers" function on the webserver. (Exploitation does not require CVE-2018-15573, because the license file is meant to be changed in the application.)

Vulnerability:

A license file containing the following, would execute calc.exe as an example of this vulnerability, it is also possible to provide arguments to the executables:

ISV demo "C:\Windows\System32\calc.exe"

If CVE-2018-15573 remains unpatched, files could be created on the system and then executed.

Recommendation:
Don't allow user-specified binaries to be run. Use a allow-list if absolutely required.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Grafana Arbitrary File Reading

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
Grafana suffers from an unauthorized arbitrary file reading vulnerability. Version 8.3.1 addresses this issue.

MD5 | b07119f68d1f96828ea48a5529ee09b5

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Reprise License Manager 14.2 Unauthenticated Password Change

https://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png
Reprise License Manager version 14.2 suffers from a missing authentication vulnerability that allows for password changing of any existing user.

MD5 | 6e10e8f8887bc874e1ca493b558c5168

Download

# Product: Reprise License Manager 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2021-44152
# Vulnerability Title: Unauthenticated Password Change
# Severity: High
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard
# Date: 2021-11-25
#############################################################
Introduction:
Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid users from accessing the system and granting the attacker full access to that user's account.

Vulnerability:
If an unauthenticated user sends the following HTTP request they can change the password of any user:

POST /goform/change_password_process HTTP/1.1
Host: 127.0.0.1:5054
Content-Length: 53

pw1=passwd&pw2=passwd&user=admin&ok=CHANGE%2BPASSWORD

Recommendation:
Ensure that authentication is required prior to password change requests and that users cannot modify or change passwords of others users.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Docker runc Command Execution Proof Of Concept

https://3.bp.blogspot.com/-XNOhyhmygqg/WWlvTLzMLRI/AAAAAAAAINo/1vKZqL-UEc0yrpuP08mTX_Jxjx_k32PvQCLcBGAs/s1600/h41.png
Docker proof of concept command execution exploit that leverages runc.

MD5 | 5b4cd873fd1dfaac2aa0a05de3311410

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Reprise License Manager 14.2 Session Hijacking

https://4.bp.blogspot.com/-OTiSJPLOhfQ/WWlvdFudhmI/AAAAAAAAIPg/Ji3s4Viv0XwGl76TD9pbO-WowW5kHfgewCLcBGAs/s1600/h78.png
Reprise License Manager version 14.2 suffers from an unauthenticated session hijacking vulnerability via brute forcing.

MD5 | a1dffd2c337ea3b468c88a04bf944708

Download

# Product: Reprise License Manager 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2021-44151
# Vulnerability Title: Unauthenticated Session Hijacking
# Severity: Medium/High
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard
# Date: 2021-11-25
#############################################################
Introduction:
As the session cookies are short and simple, an attacker can hijack any existing sessions by bruteforcing the 4 hex-character session cookie on the Windows version (the Linux version appears to have 8 characters). An attacker can obtain the static part of the cookie (cookie name) by first making a request to any page on the application (e.g.,/goforms/menu) and saving the name of the cookie sent with the response.
The attacker can then use the name of the cookie and try to request that same page, setting a random value for the cookie. If any user has an active session, the page should return with the authorized content, when a valid cookie value is hit.

Vulnerability:
Due to the session cookies being rather simple and predictable, a single session, can be brute forced in less than 3 minutes, on a laptop, and can therefore be considered very insecure.

Recommendation:
It is recommended to follow industry standards and use secure randomized complex session cookies which expire when not in use or the user de-authenticates.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Steghide Hidden Data Extraction

https://2.bp.blogspot.com/-Nz8u9CyJbsU/WWlveW9d4WI/AAAAAAAAIPw/tdSVtwWBcYIHlgRN6nbdKVd_fE-UdNKsACLcBGAs/s1600/h80.png
Stegcrack is an open-source program for exploiting a vulnerability in Steghide. Stegcrack detects whether a given file contains data hidden with Steghide, and can sometimes fully extract the hidden data, all with no password.

MD5 | 21ac61b8540814dd9c2f98ff906b7e38

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video