daikichi kaitori Luxury Japenese Buyback services (2000+ sotres) pwned + active vulns

[16]

sup fuckers.

So i just spent the last 30 minutes laughing my ass off at this site. it's Buyback Daikichi (買取大吉) they have 2000+ stores, and fuck all security apparently.

anyway this is just my post to take credit for it.

---

If you're from the company or some law enforcement agency, here is what you want to know. for anyone else just skip this, i'll continue below.

exploitation: i got shell admin access and you dip shits had no compartmentalization.
 

• 45 staff accounts, full names + emails. (ID: 43, Email: daichi.horisawa@rebear.co.jp || ID: 42, Email: koei.nakamura@rebear.co.jp)
  
• 33,366 media files incl 43 archives from customers
  
• 1200+ invoices w/ customer address.
  
• 10 shops with active staff, hours, schedules, deliveries, emails, employee introductions with photos and addresses, etc. (Kimura, Sales Department Manager || Contact Info: TEL 048-767-8036 / FAX 048-767-8037)
  

 

---

──────────────────────────────────────────────────────────
買 取 大 吉 新 宿 本 店
Buyback Daikichi Shinjuku Main Store
〒160-0022 東京都新宿区新宿3-14-21
TEL 0120-15-1234 FAX 03-6273-1914
運営: 株式会社エンパワー
──────────────────────────────────────────────────────────
請求書 INVOICE

請求書番号: 2026-0819-0147-382
請求日: 2026-08-19
支払期限: 2026-09-18

お客先 / Billed to:
KLAUS, Martin (K-4821)
〒113-0023 東京都文京区湯島3-7-12
03-5802-4471

──────────────────────────────────────────────────────────
日付 内容 金額(円)
2026-08-19 委託販売手数料 10,800
2026-08-19 出張買取手数料 4,050
────────────────────────────────────────
合計 ¥14,850

── shop_id 0147 ─────────────────────────────
店: 買取大吉 新宿本店
addr: 〒160-0022 東京都新宿区新宿3-14-21
hrs: 10:00-20:00 (closed: none — open year round)
tel: 0120-15-1234
staff:
09:45 tetsuo.mori open + safe count
10:00 yuki.tanabe floor / appraisal
12:00 kenta.ishida lunch relief + outbound buys (午前の出張分)
14:00 mika.furusawa floor / appraisal
16:00 tetsuo.mori outbound run #2 (registered buyback)
19:15 yuki.tanabe close + register tally
notes: outbound buyer list attached in the zip, 3 customer names w/ phone numbers inside.

── shop_id 0203 ─────────────────────────────
店: 買取大吉 銀座中央通り店
addr: 〒104-0061 東京都中央区銀座6-9-6 ダイアナ菊水ビル 6F
hrs: 10:00-19:00 (closed: none)
tel: 0120-15-1234 / FAX 03-6280-6222
staff:
09:30 haruka.shimizu open + safe
10:00 sota.ogawa floor
13:00 haruka.shimizu break rot 1
15:00 rin.katayama floor (part, 15:00-19:00)
18:30 sota.ogawa close prep
19:00 haruka.shimizu close + cash count

---

Ok Vulns:

thanks for stroking the shit out of my ego reading this credit post. here's some fun shit u can do to their site in the meantime as a thank you.
 

• nginx path-block bypass via ?rest_route= || if the host 403's /wp-json/ and xmlrpc.php by path, WordPress still serves the entire REST API through the query form: /?rest_route=/wp/v2/users.
  
• ?author=N user enumeration || loop ?author=1..N
  
• /wp/v2/users returns avatar URLs for every account, which are sha256(email) hashes.
  
• customer files in /uploads/ || staging installs (theirs is at /mrt_wp/)
  
  
  
  upgrade = permanent sig spot
  

my only goal is to get an upgrade or contributor rank so i have post in sellers bay <3

Verify my PGP key before doing any business. I have imposters. 


If you are a law enforcement agency or a company looking to reach me:
Contract me at: TheCrimsonBlack@proton.me 
This is the only contact I use to discuss with law enforcement or companies.  


Salud

- CB

[16]

Bump

Verify my PGP key before doing any business. I have imposters. 


If you are a law enforcement agency or a company looking to reach me:
Contract me at: TheCrimsonBlack@proton.me 
This is the only contact I use to discuss with law enforcement or companies.  


Salud

- CB