Exploit Collector
CMSimple 5.2 Cross Site Scripting

https://3.bp.blogspot.com/-3DxkerR7uq4/WWlu9h9UGfI/AAAAAAAAIJw/dRDCcwrw3XEGYQWUo-AXJEEU7FQ8iTgpACLcBGAs/s1600/h115.png
CMSimple version 5.2 suffers from a persistent cross site scripting vulnerability.

MD5 | 354482644f988f2d741a7f3bfad57674

Download
Source:packetstormsecurity.com

Exploit Collector
Trojan-Downloader.Win32.Genome.omht Insecure Permissions

https://4.bp.blogspot.com/-mbNmyGHywr4/WWlve-suujI/AAAAAAAAIP4/9elXOC6IHOcW_3VzQDLCix2bjP9zh38ZgCLcBGAs/s1600/h83.png
Trojan-Downloader.Win32.Genome.omht malware suffers from an insecure permissions vulnerability.

MD5 | b5b150be07257ed121639fd339c02bdb

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/01055838361f534ab596b56a19c70fef.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Downloader.Win32.Genome.omht
Vulnerability: Insecure Permissions
Description: Genome.omht creates an insecure dir named "wjmd97" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executables dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 01055838361f534ab596b56a19c70fef
Vuln ID: MVID-2021-0165
Dropped files: Jmd2PDF.exe, Receptor.exe, UpdateVIReceptor.exe
Disclosure: 04/07/2021
Exploit/PoC:
C:\>cacls wjmd97
C:\wjmd97 BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
C:\>cd wjmd97

C:\wjmd97>dir
Volume in drive C has no label.

Directory of C:\wjmd97

03/11/2016 08:21 AM 73,728 Jmd2PDF.exe
12/19/2017 08:16 AM 17,588,224 Receptor.exe
06/24/2013 12:32 PM 578,629 UpdateVIReceptor.exe
3 File(s) 18,240,581 bytes
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Trojan-Downloader.Win32.Genome.qiw Insecure Permissions

https://2.bp.blogspot.com/-GUn1a49o67Q/WWlu9F-J_rI/AAAAAAAAIJo/HAAKEGfKUXIq4oSJFA9qEBzdRn_AvSgtACLcBGAs/s1600/h113.png
Trojan-Downloader.Win32.Genome.qiw malware suffers from an insecure permissions vulnerability.

MD5 | 00a3fd2fe45a56e989c84555bf89a8e4

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/5cddc4647fb1c59f5dc7f414ada7fad4.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Downloader.Win32.Genome.qiw
Vulnerability: Insecure Permissions
Description: Genome.qiw creates an insecure dir named "tmp" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executables dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 5cddc4647fb1c59f5dc7f414ada7fad4
Vuln ID: MVID-2021-0164
Dropped files: 003.exe, BtPlayer_Setup_9999.exe
Disclosure: 04/07/2021

Exploit/PoC:
C:\>cacls tmp
C:\tmp BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
C:\>dir \tmp
Volume in drive C has no label.

Directory of C:\tmp

09/02/2009 02:59 PM 25,076 003.exe
09/02/2009 02:57 PM 2,218,086 BtPlayer_Setup_9999.exe
2 File(s) 2,243,162 bytes
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Composr 10.0.36 Shell Upload

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
Composr version 10.0.36 suffers from a remote shell upload vulnerability.

MD5 | 735eb24f76261ce2e85c105910c3e39c

Download
# Exploit Title: Composr 10.0.36 - Remote Code Execution
# Date: 04/06/2021
# Exploit Author: Orion Hridoy
# Vendor Homepage: https://compo.sr/
# Software Link: https://compo.sr/download.htm
# Version: 10.0.36
# Tested on: Windows/Linux
# CVE : CVE-2021-30149

A RCE on Composr CMS has been discovered by BugsBD Private LTD. We have a galleries security issue which allows us to upload a PHP file. Whenever we upload an image from galleries, Composr allows us to upload only images. If we tried to upload a PHP file from galleries uploader it will say someone attempting hacking activities. But we have a security issue on the Upload In Bulk section. Whenever we check allowed extension in Upload in bulk function we can see PHP is completely prohibited. But whenever we tamper the request and change the extension we can see it will upload the PHP file without other or server side verification. This allows a user to upload malicious file even when they restricted it.

Steps To Reproduce:
1. Go to upload galleries.
2. Upload a image and tamper the request and change the extension from .jpg to .php
3. It will say hacking attempts, check the allowed extension and you can see it's not accepting PHP extension.
4. Now go to upload in bulk option.
5. Upload a image with PHP codes and tamper the request.
6. Change extension from .jpg to .php
7. It will get uploaded with the blocked PHP extension.


Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Handcuffs Over AI: Solving Security Challenges With Law Enforcement

We've tried everything else ... now it's time to make the prospect of getting caught -- and punished -- a real deterrent to cybercrime.

Kali Linux Tutorials
Kics : Find Security Vulnerabilities & Compliance Issues

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx. KICS stands for Keeping Infrastructure as Code Secure, it is open source and is a must-have for any cloud native project. Supported Platforms Support of other solutions and additional cloud providers are on the roadmap. […]

The post Kics : Find Security Vulnerabilities & Compliance Issues appeared first on Kali Linux Tutorials.

Hacking on Medium
Playing The Chain Game

https://cdn-images-1.medium.com/max/600/1*GQhp2wOV4wtSfONoDPvoZA.jpeg
#First Valid Bug

Continue reading on Medium »

Hacking on Medium
HOW I GOT MY NAME IN BBC’S HALL OF FAME

https://cdn-images-1.medium.com/max/600/1*HQmIX9n4miVy5j8FTvtWsA.gif
Hi Everyone, Hope you all are doing well and hunting bugs ;)

Continue reading on Medium »

Hacking on Medium
How Virtual Servers are vulnerable to exploitation

https://cdn-images-1.medium.com/max/1200/1*H880iByZ7oETOM_2y-IfpQ.jpeg
Companies are working with petabytes of data every day. This data is collected across thousands of inputs from questionnaires to cookies…

Continue reading on Shadowscape »

Hacking on Medium
Algunas reflexiones sobre filosofía

https://cdn-images-1.medium.com/max/2600/1*UKXnPGs-jKN_HNztxx1XeA.jpeg
Artículo sobre algunas reflexiones de temas filosóficos como el tiempo, la muerte, el equilibrio, el poder y la libertad.

Continue reading on Medium »