Hacking Articles Tips Tricks Videos Tutorials

4 views02:20

Exploit Collector
Markdown-Explorer 0.1.1 Cross Site Scripting / Code Execution

https://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png
Markdown-Explorer version 0.1.1 suffers from a cross site scripting vulnerability that can lead to remote code execution.

MD5 | fc8011faa7d4469e905701a412002aa4

Download

# Exploit Title: Markdown-Explorer 0.1.1 XSS to RCE
# Exploit Author: TaurusOmar
# Twitter:@TaurusOmar
# HomePage:taurusomar.com
# Date: May 4th, 2021
# CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
# Risk: High (8.8)
# Vendor Homepage: https://github.com/jersou/markdown-explorer
# Version: 0.1.1
# Tested on: Windows, Linux, MacOs

# Software Description:
Easily explore, view and edit markdown documentation of a file tree.
If your projects documentation is written in Markdown, with md files dispersed throughout your project tree, Markdown Explorer displays md files in a tree structure, and it allows filtering by file name or by file content.
Just drop a folder on the window (or click on the folder icon on top left) to show the Markdown documentation of this folder. Then, explore the tree on the left, and toggle view/edit mode on md file with the button on the top right.
# Vulnerability Description:
The software allows you to store payloads within its own editor, as well as upload (.md) files once malicious code is entered, the payload will be executed immediately.
The attacker can send a malicious file with the payload, when this file is opened, the chain will be executed successfully giving access to
the remote attacker to get remote execution on the computer.
#Proof
https://imgur.com/a/w4bcPWs
# Payload : exec(Attacker Reverse netcat stolen => /etc/passwd) && exec(calc)

[](http://)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Markdown-Explorer 0.1.1 Cross Site Scripting / Code Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 02:20

Hacking Articles Tips Tricks Videos Tutorials

7 views02:20

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
SnipCommand 0.1.0 Cross Site Scripting / Code Execution

https://4.bp.blogspot.com/-sHG2jViTb-c/WWlvSCf2XfI/AAAAAAAAINY/YxfxwjOK_o05QB9TpuqqysTdHaIb3yf8wCLcBGAs/s1600/h36.png
SnipCommand version 0.1.0 suffers from a cross site scripting vulnerability that can lead to remote code execution.

MD5 | 34dc1fa9d8c9fea6965bfb141eda50dc

Download

# Exploit Title: SnipCommand 0.1.0 XSS to RCE
# Exploit Author: TaurusOmar
# Twitter:@TaurusOmar
# HomePage:taurusomar.com
# Date: May 4th, 2021
# CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
# Risk: High (8.8)
# Vendor Homepage: https://github.com/gurayyarar/SnipCommand
# Version: 0.1.0
# Tested on: Windows, Linux, MacOs

# Software Description:
Open source command snippets manager for organize and copy fast.
It helps you create, organize and store your commands (Excel formulas, Sql Queries, Terminal commands, etc.) with dynamic parameters for quick copy to it. Describe your commands with dynamic parameters also support documentation about your snippets. You can select or specify your dynamic values using with selectbox/inputbox for ready to paste the workspace. You can organize with tags.
# Vulnerability Description:
The software allows you to store payloads in the form of files or as titles in their dynamic values, once the malicious code is entered, the payload will be executed immediately.
The attacker can send a malicious file with the payload, when this file is opened, the chain will be executed successfully giving access to the
the remote attacker to get remote execution on the computer.

#Proof video
https://imgur.com/a/I2reH1M
# Payload: exec(Attacker Reverse netcat stolen => /etc/passwd) && exec(calc)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

SnipCommand 0.1.0 Cross Site Scripting / Code Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 02:20

Hacking Articles Tips Tricks Videos Tutorials

6 views02:20

Hacking Articles Tips Tricks Videos Tutorials

6 views02:20

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Backdoor.Win32.Floder.gqe Insecure Permissions

https://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png
Backdoor.Win32.Floder.gqe malware suffers from an insecure permissions vulnerability.

MD5 | 7a96c300f8bf1d4f77f000871c8fcc6c

Download

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/0629e3b2ab8a973a3e37e4e97cb9cfea.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Floder.gqe
Vulnerability: Insecure Permissions
Description: The malware creates an hidden insecure dir named "RECYCLER" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executables dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 0629e3b2ab8a973a3e37e4e97cb9cfea
Vuln ID: MVID-2021-0200
Dropped files: zaberg.exe, Desktop.ini
Disclosure: 05/04/2021

Exploit/PoC:
C:\>cacls RECYCLER
C:\RECYCLER BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
C:\>dir /a RECYCLER
Volume in drive C has no label.

Directory of C:\RECYCLER

05/01/2021  11:11 PM S-1-5-21-0243556031-888888379-781863308-1830
0 File(s)              0 bytes
3 Dir(s)   7,337,779,200 bytes free

C:\>cd \RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830

C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830>dir /a
Volume in drive C has no label.

Directory of C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830

05/01/2021  11:11 PM                63 Desktop.ini
06/17/2012  02:46 AM            24,064 zaberg.exe
2 File(s)         24,127 bytes
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).