exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 63 RSS Feed

Files from Matthew Bergin

Email addressmbergin at grapeking.com
First Active2009-11-06
Last Active2022-01-31
Moxa TN-5900 Post Authentication Command Injection
Posted Jan 31, 2022
Authored by Matthew Bergin, Josh Hardin | Site korelogic.com

Moxa TN-5900 versions 3.1 and below suffer from an issue where a user who has authenticated to the management web application is able to leverage a command injection vulnerability in the p12 processing code of the certificate management function web_CERMGMTUpload.

tags | exploit, web
advisories | CVE-2021-46560
SHA-256 | 35bd8ec3c5b38937aa9d5775e8ed2feaacd3dfed7c92d6ae96cb03bf16903bcb
Moxa TN-5900 Firmware Upgrade Checksum Validation
Posted Jan 31, 2022
Authored by Matthew Bergin, Josh Hardin | Site korelogic.com

Moxa TN-5900 versions 3.1.0 and below use an insecure method to validate firmware updates. A malicious user with access to the management interface can upload arbitrary code in a crafted

tags | exploit, arbitrary
advisories | CVE-2021-46559
SHA-256 | 2ac55dc0e94a52eae63ae9272eda3788cbe1002c37fa22d4db10498c8ab74404
Barco wePresent Insecure Firmware Image
Posted Nov 20, 2020
Authored by Matthew Bergin, Jim Becher | Site korelogic.com

Barco wePresent WiPG-1600W versions 2.5.1.8, 2.5.0.25, 2.5.0.24, and 2.4.1.19 have firmware that does not perform verification of digitally signed firmware updates and is susceptible to processing and installing modified/malicious images.

tags | exploit
advisories | CVE-2020-28332
SHA-256 | ce155e50978552faf0e472116a9c5ce4f975a3420fd6632369708f93d1554c2a
Cellebrite EPR Decryption Hardcoded AES Key Material
Posted Jun 30, 2020
Authored by Matthew Bergin | Site korelogic.com

The Cellebrite UFED Physical device relies on key material hardcoded within both the executable code supporting the decryption process and within the encrypted files themselves by using a key enveloping technique. The recovered key material is the same for every device running the same version of the software and does not appear to be changed with each new build. It is possible to reconstruct the decryption process

tags | exploit
advisories | CVE-2020-14474
SHA-256 | 8e1693c954c2b9222de10e46717620d6631dc916f4d2bd744336668d271dbc33
Cellebrite UFED 7.5.0.845 Desktop Escape / Privilege Escalation
Posted May 14, 2020
Authored by Matthew Bergin | Site korelogic.com

Cellebrite UFED device implements local operating system policies that can be circumvented to obtain a command prompt. From there privilege escalation is possible using public exploits. Versions 5.0 through 7.5.0.845 are affected.

tags | exploit, local
advisories | CVE-2020-12798
SHA-256 | 202a3e49b06ab6981d9b3b6aaf73e839d47d6ee0fd59c7be3f7bd017a0f6dd70
Cellebrite UFED 7.29 Hardcoded ADB Authentication Keys
Posted Apr 13, 2020
Authored by Matthew Bergin | Site korelogic.com

Cellebrite UFED versions 5.0 through 7.29 use four hardcoded RSA private keys to authenticate to the ADB daemon on target devices. Extracted keys can be used to place evidence onto target devices when performing a forensic extraction.

tags | exploit
advisories | CVE-2020-11723
SHA-256 | 135405ff4806330d49060bed8cf3402ff174759f5f4ee2d7d009d9ee3f479b76
Dell OpenManage Network Manager 6.2.0.51 SP3 Privilege Escalation
Posted Nov 6, 2018
Authored by Matthew Bergin | Site korelogic.com

Dell OpenManage Network Manager exposes a MySQL listener that can be accessed with default credentials. This MySQL service is running as the root user, so an attacker can exploit this configuration to, e.g., deploy a backdoor and escalate privileges into the root account.

tags | exploit, root
advisories | CVE-2018-15767, CVE-2018-15768
SHA-256 | 22a16815587703eaaa022a8f7fc66731fbd250580052e1ef2522bcc959b5b6ff
HP VAN SDN Controller Root Command Injection
Posted Jul 7, 2018
Authored by Matthew Bergin, wvu | Site metasploit.com

This Metasploit module exploits a hardcoded service token or default credentials in HPE VAN SDN Controller versions 2.7.18.0503 and below to execute a payload as root. A root command injection was discovered in the uninstall action's name parameter, obviating the need to use sudo for privilege escalation. If the service token option TOKEN is blank, USERNAME and PASSWORD will be used for authentication. An additional login request will be sent.

tags | exploit, root
SHA-256 | eea257b390a3b287d462cce58af78297233c499f3594b67b9e26d2aa119c09e9
HP Enterprise VAN SDN Controller 2.7.18.0503 Remote Root
Posted Jun 26, 2018
Authored by Matthew Bergin | Site korelogic.com

HP Enterprise VAN SDN Controller version 2.7.18.0503 suffers from an unauthenticated remote root vulnerability. A hard-coded service token can be used to bypass authentication. Built-in functionality can be exploited to deploy and execute a malicious deb file containing a backdoor. A weak sudoers configuration can then be abused to escalate privileges to root. A second issue can be used to deny use of the appliance by continually rebooting it.

tags | exploit, remote, root
SHA-256 | ca4e710786607c8db2b5551765fad05ea1626ff8a4bd00aa2997feded7590990
Sophos UTM 9 loginuser Privilege Escalation
Posted Mar 2, 2018
Authored by Matthew Bergin | Site korelogic.com

Sophos UTM 9 version 9.410 suffers from a loginuser privilege escalation vulnerability.

tags | exploit
SHA-256 | 6d19a2e36a1817afe48ae38b69347eba16c4c1a70844cc67eafee5f5f2582e45
Trend Micro IMSVA Management Portal 9.1.0.1600 Authentication Bypass
Posted Feb 9, 2018
Authored by Matthew Bergin | Site korelogic.com

Trend Micro IMSVA Management Portal version 9.1.0.1600 suffers from an authentication bypass vulnerability.

tags | exploit, bypass
SHA-256 | c7a07a038914e37b8bfa9c05e6db471f4711c61717d34ae44ed1f91e9397d82c
NetEx HyperIP 6.1.0 Local File Inclusion
Posted Feb 9, 2018
Authored by Matthew Bergin | Site korelogic.com

NetEx HyperIP version 6.1.0 suffers from a local file inclusion vulnerability.

tags | exploit, local, file inclusion
SHA-256 | fb130f6f8457644d60ce69b933c8c0f2f4d3daf7e1620fb59e66f170ae55d898
NetEx HyperIP 6.1.0 Privilege Escalation
Posted Feb 9, 2018
Authored by Matthew Bergin | Site korelogic.com

NetEx HyperIP version 6.1.0 suffers from a privilege escalation vulnerability.

tags | exploit
SHA-256 | b6b3f5ba58facfba2eb1750f336aa647a91315ae13af6f460253387be0c2135f
NetEx HyperIP 6.1.0 Post-Auth Command Execution
Posted Feb 9, 2018
Authored by Matthew Bergin | Site korelogic.com

NetEx HyperIP version 6.1.0 suffers from a post-authentication command execution vulnerability.

tags | exploit
SHA-256 | 89fd3d5488d7653bb4f6d11f9248ebdc5bc0f4879c689f426770de2762eafd88
NetEx HyperIP 6.1.0 Authentication Bypass
Posted Feb 9, 2018
Authored by Matthew Bergin | Site korelogic.com

NetEx HyperIP version 6.1.0 suffers from an authentication bypass vulnerability.

tags | exploit, bypass
SHA-256 | d733aa8090655285b530947e6da39649927c222f511db1714d856155388a8a84
Sophos Web Gateway 4.4.1 Cross Site Scripting
Posted Jan 26, 2018
Authored by Matthew Bergin | Site korelogic.com

Sophos Web Gateway version 4.4.1 suffers from a persistent cross site scripting vulnerability.

tags | exploit, web, xss
SHA-256 | 137dda80750280087cb36ed57d850fc6348d18929065d814c14652da40181992
Sophos UTM 9 Management Appplication Local File Inclusion
Posted Oct 25, 2017
Authored by Matthew Bergin | Site korelogic.com

Sophos UTM 9 suffers from a local file inclusion vulnerability. Version 9.410 is affected.

tags | exploit, local, file inclusion
SHA-256 | ba17012c9d21cd3e781e366f214abfdf9faf9780535e543ae9cf3a40603af138
Sophos UTM 9 loginuser Privilege Escalation Via Insecure Directory Permissions
Posted Oct 25, 2017
Authored by Matthew Bergin | Site korelogic.com

Sophos UTM 9 suffers from a loginuser privilege escalation vulnerability via insecure directory permissions. Version 9.410 is affected.

tags | exploit
SHA-256 | fd8843e98bd26838d92a0d52e8d9620f3e5d6a90bc1aa8cc078996b66040699a
Sonicwall WXA5000 1.3.2-10-30 Console Jail Escape / Privilege Escalation
Posted Oct 25, 2017
Authored by Matthew Bergin | Site korelogic.com

Sonicwall WXA5000 version 1.3.2-10-30 suffers from console jail escape and privilege escalation vulnerabilities.

tags | exploit, vulnerability
SHA-256 | 528772153763dde340abad6b6f539c06481ea3af1b1c1bc7eda3277928a19022
Infoblox NetMRI VM-AD30-5C6CE Factory Reset Persistence
Posted Oct 25, 2017
Authored by Matthew Bergin | Site korelogic.com

Infoblox NetMRI version VM-AD30-5C6CE suffers from an administration shell factory reset persistence vulnerability.

tags | exploit, shell
SHA-256 | b441994193d057c810483b9cd2d4dad307269cc38772ac61db1b6c79283f9899
Infoblox NetMRI 7.1.4 Shell Escape / Privilege Escalation
Posted Oct 25, 2017
Authored by Hank Leininger, Matthew Bergin | Site korelogic.com

Infoblox NetMRI versions 7.1.2 through 7.1.4 suffer from administration shell escape and privilege escalation vulnerabilities.

tags | exploit, shell, vulnerability
SHA-256 | cf2764068642712d57bf637c469af8efd08229679a4265ceb71c2691a388b2a0
Solarwinds LEM 6.3.1 Hardcoded Credentials
Posted Jul 7, 2017
Authored by Matthew Bergin, Joshua Hardin | Site korelogic.com

Solarwinds Log and Event Manager Virtual Appliance version 6.3.1 has hard-coded credentials.

tags | exploit
SHA-256 | db2280c889805e3b1cc8bca7d28bca9faff15b7e7003176695d43071203d731f
Barracuda WAF V360 Firmware 8.0.1.014 Support Tunnel Hijack
Posted Jul 7, 2017
Authored by Matthew Bergin, Joshua Hardin | Site korelogic.com

Barracuda WAF V360 with firmware 8.0.1.014 suffers from a support tunnel hijacking vulnerability.

tags | exploit
SHA-256 | b5f3e2e56c5e431a0f7904096cd26eb5b819f5e04765f0ca18b7e34eeb0f1740
Barracuda WAF V360 Firmware 8.0.1.014 Username / Session ID Leak
Posted Jul 6, 2017
Authored by Matthew Bergin, Joshua Hardin | Site korelogic.com

The Barracuda WAF management application transmits the current user and session identifier over HTTP GET. Firmware version 8.0.1.014 is affected.

tags | exploit, web
SHA-256 | 7086b580e0510a02f02451754011dfa92817d22fce4942667a0c2c95727a7c68
Barracuda WAF V360 Firmware 8.0.1.014 Grub Password Complexity
Posted Jul 6, 2017
Authored by Matthew Bergin, Joshua Hardin | Site korelogic.com

The grub password for all Barracuda WAF V360 virtual appliances is four characters in length and, as a result, may be trivially easy to crack. Firmware version 8.0.1.014 is affected.

tags | exploit
SHA-256 | c30a6c337f827c7f205331146c21efde524fe526807aea264c31e3482104d705
Page 1 of 3
Back123Next

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    9 Files
  • 7
    Feb 7th
    33 Files
  • 8
    Feb 8th
    34 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close